@tracegraph/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2597 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/index.ts
+var import_commander = require("commander");
+var import_shared_types14 = require("@tracegraph/shared-types");
+
+// src/commands/run.ts
+var import_child_process = require("child_process");
+var import_fs2 = __toESM(require("fs"));
+var import_path2 = __toESM(require("path"));
+var import_trace_core = require("@tracegraph/trace-core");
+var import_shared_types = require("@tracegraph/shared-types");
+
+// src/protocol.ts
+function emit(fields) {
+  const envelope = {
+    protocol: "tracegraph.cli.v1",
+    timestamp: Date.now(),
+    ...fields
+  };
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+function emitError(runId, message, detail) {
+  process.stderr.write(`[tracegraph] Error: ${message}
+`);
+  if (detail) {
+    process.stderr.write(`[tracegraph] Detail: ${String(detail)}
+`);
+  }
+  emit({
+    type: "error",
+    runId,
+    payload: { message, detail: String(detail ?? "") }
+  });
+}
+
+// src/config.ts
+var import_fs = __toESM(require("fs"));
+var import_path = __toESM(require("path"));
+var CONFIG_FILENAME = "tracegraph.config.json";
+function loadConfig(workspaceRoot) {
+  const configPath = import_path.default.join(workspaceRoot, CONFIG_FILENAME);
+  if (!import_fs.default.existsSync(configPath)) {
+    return {};
+  }
+  try {
+    return JSON.parse(import_fs.default.readFileSync(configPath, "utf8"));
+  } catch (err) {
+    process.stderr.write(
+      `[tracegraph] Warning: could not parse ${configPath}: ${String(err)}
+[tracegraph] Using default configuration.
+`
+    );
+    return {};
+  }
+}
+
+// src/commands/run.ts
+function detectAndInjectReporter(args, workspaceRoot) {
+  const messages = [];
+  let runner = null;
+  for (const arg of args) {
+    const base = import_path2.default.basename(arg).toLowerCase();
+    if (/^vitest(\.cmd)?$/.test(base)) {
+      runner = "vitest";
+      break;
+    }
+    if (/^jest(\.cmd)?$/.test(base)) {
+      runner = "jest";
+      break;
+    }
+  }
+  if (!runner) {
+    const joined = args.join(" ").toLowerCase();
+    if (/\bvitest\b/.test(joined)) runner = "vitest";
+    else if (/\bjest\b/.test(joined)) runner = "jest";
+  }
+  if (!runner) {
+    messages.push(
+      "TraceGraph: no test reporter detected \u2014 capture level will be 0\u20131",
+      "Recommendation: add @tracegraph/vitest or @tracegraph/jest for test-level tracing"
+    );
+    return { args, messages, injected: false, runner: null };
+  }
+  const alreadyPresent = args.some(
+    (a) => /--reporters?=@tracegraph\//i.test(a)
+  );
+  let alreadyPresentByPair = false;
+  for (let i = 0; i < args.length - 1; i++) {
+    if ((args[i] === "--reporter" || args[i] === "--reporters") && (args[i + 1] ?? "").startsWith("@tracegraph/")) {
+      alreadyPresentByPair = true;
+      break;
+    }
+  }
+  const explicitConfig = extractConfigArg(args);
+  const hasReporterInConfig = checkVitestConfigForTraceGraphReporter(workspaceRoot, explicitConfig);
+  if (alreadyPresent || alreadyPresentByPair || hasReporterInConfig) {
+    messages.push(
+      `TraceGraph: detected ${runner} \u2014 @tracegraph/${runner} reporter already present, skipping injection`
+    );
+    return { args, messages, injected: false, runner };
+  }
+  let injectedArgs;
+  if (runner === "vitest") {
+    injectedArgs = [...args, "--reporter=default", "--reporter=@tracegraph/vitest"];
+    messages.push(
+      `TraceGraph: detected Vitest \u2014 injecting @tracegraph/vitest reporter (Level 5)`
+    );
+  } else {
+    injectedArgs = [...args, "--reporters=default", "--reporters=@tracegraph/jest"];
+    messages.push(
+      `TraceGraph: detected Jest \u2014 injecting @tracegraph/jest reporter (Level 5)`
+    );
+  }
+  return { args: injectedArgs, messages, injected: true, runner };
+}
+function checkVitestConfigForTraceGraphReporter(workspaceRoot, extraConfigPath) {
+  const configCandidates = [
+    "vitest.config.ts",
+    "vitest.config.js",
+    "vitest.config.mts",
+    "vitest.config.mjs"
+  ];
+  const pathsToCheck = configCandidates.map((n) => import_path2.default.join(workspaceRoot, n));
+  if (extraConfigPath) {
+    pathsToCheck.push(
+      import_path2.default.isAbsolute(extraConfigPath) ? extraConfigPath : import_path2.default.join(workspaceRoot, extraConfigPath)
+    );
+  }
+  for (const p of pathsToCheck) {
+    if (import_fs2.default.existsSync(p)) {
+      try {
+        const content = import_fs2.default.readFileSync(p, "utf8");
+        if (content.includes("@tracegraph/vitest") || content.includes("TraceGraphReporter")) {
+          return true;
+        }
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function extractConfigArg(args) {
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--config=")) return arg.slice("--config=".length);
+    if (arg === "--config" || arg === "-c") return args[i + 1];
+  }
+  return void 0;
+}
+async function runCommand(wrappedArgs2, options) {
+  if (wrappedArgs2.length === 0) {
+    process.stderr.write(
+      "Usage: tracegraph run [options] -- <command> [args]\nExample: tracegraph run -- npm test\n"
+    );
+    return import_shared_types.EXIT_CODES.CLI_ERROR;
+  }
+  const workspaceRoot = process.cwd();
+  const config = loadConfig(workspaceRoot);
+  const runId = options.runId ?? (0, import_trace_core.createRunId)();
+  const traceId = (0, import_trace_core.createTraceId)();
+  const sessionId = (0, import_trace_core.createSessionId)();
+  const startedAt = Date.now();
+  const tracegraphDir = import_path2.default.join(workspaceRoot, ".tracegraph");
+  const runDir = import_path2.default.join(tracegraphDir, "runs", runId);
+  const tracesDir = import_path2.default.join(tracegraphDir, "traces");
+  import_fs2.default.mkdirSync(runDir, { recursive: true });
+  import_fs2.default.mkdirSync(tracesDir, { recursive: true });
+  const injection = detectAndInjectReporter(wrappedArgs2, workspaceRoot);
+  for (const msg of injection.messages) {
+    process.stderr.write(`${msg}
+`);
+  }
+  const effectiveArgs = injection.args;
+  const [command, ...commandArgs] = effectiveArgs;
+  const commandStr = wrappedArgs2.join(" ");
+  const entrypoint = { type: "cli_command", command: commandStr };
+  emit({ type: "run.started", runId });
+  emit({ type: "trace.started", runId, traceId, payload: { entrypoint } });
+  const jsonlTmpPath = import_path2.default.join(runDir, `${traceId}.events.jsonl.tmp`);
+  const writer = new import_trace_core.TraceEventWriter(jsonlTmpPath);
+  const traceStartEventId = (0, import_trace_core.createEventId)();
+  const traceStartEvent = {
+    schemaVersion: import_shared_types.SCHEMA_VERSIONS.event,
+    eventId: traceStartEventId,
+    traceId,
+    parentEventId: null,
+    type: "trace_start",
+    language: "javascript",
+    name: "trace_start",
+    startTime: startedAt,
+    metadata: { command: commandStr }
+  };
+  writer.write(traceStartEvent);
+  await writer.close();
+  let exitCode = 0;
+  let spawnErrorMsg;
+  const childEnv = {
+    ...process.env,
+    TRACEGRAPH_ENABLED: "1",
+    TRACEGRAPH_RUN_DIR: runDir,
+    TRACEGRAPH_TRACE_ID: traceId,
+    TRACEGRAPH_RUN_ID: runId,
+    TRACEGRAPH_SESSION_ID: sessionId,
+    TRACEGRAPH_ROOT_EVENT_ID: traceStartEventId
+  };
+  try {
+    if (!command) {
+      spawnErrorMsg = "No command provided";
+      exitCode = import_shared_types.EXIT_CODES.CLI_ERROR;
+    } else {
+      const result = (0, import_child_process.spawnSync)(command, commandArgs, {
+        stdio: "inherit",
+        // pass through so the user sees the command's output
+        shell: false,
+        env: childEnv
+      });
+      if (result.error) {
+        spawnErrorMsg = result.error.message;
+        exitCode = result.error.message.includes("ENOENT") ? import_shared_types.EXIT_CODES.CLI_ERROR : import_shared_types.EXIT_CODES.COMMAND_FAILURE;
+      } else {
+        exitCode = result.status ?? import_shared_types.EXIT_CODES.SUCCESS;
+      }
+    }
+  } catch (err) {
+    spawnErrorMsg = err instanceof Error ? err.message : String(err);
+    exitCode = import_shared_types.EXIT_CODES.CLI_ERROR;
+    emitError(runId, "Failed to spawn command", spawnErrorMsg);
+  }
+  const endedAt = Date.now();
+  const status = spawnErrorMsg !== void 0 ? "error" : exitCode === import_shared_types.EXIT_CODES.SUCCESS ? "passed" : "failed";
+  const traceEndEvent = {
+    schemaVersion: import_shared_types.SCHEMA_VERSIONS.event,
+    eventId: (0, import_trace_core.createEventId)(),
+    traceId,
+    parentEventId: traceStartEventId,
+    type: "trace_end",
+    language: "javascript",
+    name: "trace_end",
+    startTime: endedAt,
+    endTime: endedAt,
+    durationMs: endedAt - startedAt,
+    metadata: {
+      exitCode,
+      ...spawnErrorMsg ? { error: spawnErrorMsg } : {}
+    }
+  };
+  try {
+    import_fs2.default.appendFileSync(jsonlTmpPath, JSON.stringify(traceEndEvent) + "\n", "utf8");
+  } catch (err) {
+    emitError(runId, "Failed to write trace_end event", err);
+  }
+  let captureLevel = {
+    overall: 0,
+    label: "Runner metadata only",
+    adapters: {}
+  };
+  const captureLevelFile = import_path2.default.join(runDir, "capture-level.json");
+  if (import_fs2.default.existsSync(captureLevelFile)) {
+    try {
+      captureLevel = JSON.parse(import_fs2.default.readFileSync(captureLevelFile, "utf8"));
+    } catch {
+    }
+  }
+  let traceLanguage = "javascript";
+  let traceFramework;
+  const metaFile = import_path2.default.join(runDir, "meta.json");
+  if (import_fs2.default.existsSync(metaFile)) {
+    try {
+      const meta = JSON.parse(import_fs2.default.readFileSync(metaFile, "utf8"));
+      if (meta.language === "php") traceLanguage = "php";
+      if (meta.framework) traceFramework = meta.framework;
+    } catch {
+    }
+  }
+  const testsRunDir = import_path2.default.join(runDir, "tests");
+  const testTracePaths = [];
+  if (import_fs2.default.existsSync(testsRunDir)) {
+    const testJsonlFiles = import_fs2.default.readdirSync(testsRunDir).filter((f) => f.endsWith(".events.jsonl.tmp")).sort();
+    for (const jsonlFile of testJsonlFiles) {
+      const testTraceId = jsonlFile.replace(".events.jsonl.tmp", "");
+      try {
+        const testPath = await (0, import_trace_core.finaliseTrace)({
+          runDir: testsRunDir,
+          // reporter wrote files into the tests/ subdir
+          traceId: testTraceId,
+          tracesDir,
+          workspaceRoot,
+          sessionId,
+          runId,
+          ...options.scenarioId ? { scenarioId: options.scenarioId } : {},
+          language: traceLanguage,
+          ...traceFramework ? { framework: traceFramework } : {},
+          entrypoint,
+          startedAt,
+          endedAt,
+          status,
+          captureLevel
+        });
+        testTracePaths.push(testPath);
+      } catch {
+      }
+    }
+  }
+  let finalPath;
+  try {
+    finalPath = await (0, import_trace_core.finaliseTrace)({
+      runDir,
+      traceId,
+      tracesDir,
+      workspaceRoot,
+      sessionId,
+      runId,
+      ...options.scenarioId ? { scenarioId: options.scenarioId } : {},
+      language: traceLanguage,
+      ...traceFramework ? { framework: traceFramework } : {},
+      entrypoint,
+      startedAt,
+      endedAt,
+      status,
+      captureLevel
+    });
+  } catch (err) {
+    emitError(runId, "Failed to finalise trace", err);
+    emit({ type: "run.completed", runId, payload: { status: "error" } });
+    return import_shared_types.EXIT_CODES.CLI_ERROR;
+  }
+  try {
+    (0, import_trace_core.updateTraceIndex)(tracegraphDir, {
+      traceId,
+      runId,
+      file: import_path2.default.relative(workspaceRoot, finalPath).replace(/\\/g, "/"),
+      status,
+      createdAt: startedAt,
+      entrypoint
+    });
+  } catch {
+  }
+  try {
+    const testTraceIds = testTracePaths.map(
+      (p) => import_path2.default.basename(p, ".trace.json")
+    );
+    const latestPointer = {
+      latestRunId: runId,
+      latestTraceIds: [traceId, ...testTraceIds],
+      latestReportId: null,
+      updatedAt: Date.now()
+    };
+    import_fs2.default.writeFileSync(
+      import_path2.default.join(tracegraphDir, "latest.json"),
+      JSON.stringify(latestPointer, null, 2) + "\n",
+      "utf8"
+    );
+  } catch {
+  }
+  if (config.storage?.pruneOnRun !== false) {
+    try {
+      new import_trace_core.StorageManager(tracegraphDir, config.storage).prune();
+    } catch {
+    }
+  }
+  emit({
+    type: "trace.completed",
+    runId,
+    traceId,
+    captureLevel: { overall: captureLevel.overall, label: captureLevel.label },
+    payload: {
+      file: import_path2.default.relative(workspaceRoot, finalPath).replace(/\\/g, "/"),
+      status
+    }
+  });
+  emit({
+    type: "run.completed",
+    runId,
+    captureLevel: { overall: captureLevel.overall, label: captureLevel.label },
+    payload: { status }
+  });
+  return exitCode;
+}
+
+// src/commands/clean.ts
+var import_path3 = __toESM(require("path"));
+var import_trace_core2 = require("@tracegraph/trace-core");
+function cleanCommand(options) {
+  const workspaceRoot = process.cwd();
+  const config = loadConfig(workspaceRoot);
+  const tracegraphDir = import_path3.default.join(workspaceRoot, ".tracegraph");
+  const storage = new import_trace_core2.StorageManager(tracegraphDir, config.storage);
+  const cleanOpts = {};
+  if (options.allRuns) cleanOpts.allRuns = true;
+  if (options.keepLast !== void 0) cleanOpts.keepLast = options.keepLast;
+  if (options.olderThan) cleanOpts.olderThan = options.olderThan;
+  storage.clean(cleanOpts);
+  const status = storage.status();
+  process.stderr.write(
+    `[tracegraph] clean: done. Runs remaining: ${status.runs}. Total size: ${status.totalSizeMB} MB
+`
+  );
+}
+
+// src/commands/storage-status.ts
+var import_path4 = __toESM(require("path"));
+var import_trace_core3 = require("@tracegraph/trace-core");
+function storageStatusCommand() {
+  const workspaceRoot = process.cwd();
+  const config = loadConfig(workspaceRoot);
+  const tracegraphDir = import_path4.default.join(workspaceRoot, ".tracegraph");
+  const storage = new import_trace_core3.StorageManager(tracegraphDir, config.storage);
+  const status = storage.status();
+  const lines = [
+    "",
+    "TraceGraph Storage",
+    "\u2500".repeat(40),
+    `  Runs:        ${status.runs}`,
+    `  Traces:      ${status.traces}`,
+    `  Baselines:   ${status.baselines}`,
+    `  Total size:  ${status.totalSizeMB} MB`,
+    `  Location:    ${status.location}`,
+    ""
+  ];
+  process.stdout.write(lines.join("\n"));
+}
+
+// src/commands/open.ts
+var import_fs3 = __toESM(require("fs"));
+var import_path5 = __toESM(require("path"));
+var import_trace_core4 = require("@tracegraph/trace-core");
+var import_shared_types2 = require("@tracegraph/shared-types");
+function openCommand(traceFilePath, options) {
+  const absTracePath = import_path5.default.resolve(process.cwd(), traceFilePath);
+  if (!import_fs3.default.existsSync(absTracePath)) {
+    process.stderr.write(`[tracegraph] Trace file not found: ${absTracePath}
+`);
+    process.exit(import_shared_types2.EXIT_CODES.CLI_ERROR);
+  }
+  let trace;
+  try {
+    trace = (0, import_trace_core4.readTrace)(absTracePath);
+  } catch (err) {
+    process.stderr.write(`[tracegraph] Failed to read trace: ${String(err)}
+`);
+    process.exit(import_shared_types2.EXIT_CODES.CLI_ERROR);
+  }
+  const bundlePath = resolveBundle();
+  if (!bundlePath) {
+    process.stderr.write(
+      "[tracegraph] Webview bundle not found.\n  Build it with: pnpm --filter @tracegraph/webview build\n  Or set: TRACEGRAPH_WEBVIEW_BUNDLE=/path/to/tracegraph-viewer.iife.js\n"
+    );
+    process.exit(import_shared_types2.EXIT_CODES.CLI_ERROR);
+  }
+  const bundleJs = import_fs3.default.readFileSync(bundlePath, "utf8");
+  const bundleCss = readCssIfExists(bundlePath);
+  const traceJson = JSON.stringify(trace);
+  const title = buildTitle(trace);
+  const html = buildHtml({ title, traceJson, bundleJs, bundleCss });
+  const outPath = resolveOutPath(absTracePath, options.out, trace.traceId);
+  import_fs3.default.mkdirSync(import_path5.default.dirname(outPath), { recursive: true });
+  import_fs3.default.writeFileSync(outPath, html, "utf8");
+  process.stdout.write(`[tracegraph] HTML report: ${outPath}
+`);
+  if (!options.noOpen) {
+    openInBrowser(outPath);
+  }
+}
+function resolveBundle() {
+  const envPath = process.env["TRACEGRAPH_WEBVIEW_BUNDLE"];
+  if (envPath && import_fs3.default.existsSync(envPath)) return envPath;
+  const candidates = [
+    // From packages/cli/src/commands/ → ../../../../apps/webview/dist/
+    import_path5.default.resolve(__dirname, "../../../../apps/webview/dist/tracegraph-viewer.iife.js"),
+    // From packages/cli/dist/commands/ (built) → ../../../../apps/webview/dist/
+    import_path5.default.resolve(__dirname, "../../../../apps/webview/dist/tracegraph-viewer.iife.js"),
+    // Relative to process.cwd() (workspace root)
+    import_path5.default.resolve(process.cwd(), "apps/webview/dist/tracegraph-viewer.iife.js"),
+    // Production: next to the CLI entry
+    import_path5.default.resolve(__dirname, "../webview-bundle/tracegraph-viewer.iife.js")
+  ];
+  for (const c of candidates) {
+    if (import_fs3.default.existsSync(c)) return c;
+  }
+  return null;
+}
+function readCssIfExists(bundlePath) {
+  const cssPath = bundlePath.replace(".iife.js", ".css");
+  if (import_fs3.default.existsSync(cssPath)) {
+    return import_fs3.default.readFileSync(cssPath, "utf8");
+  }
+  return "";
+}
+function buildTitle(trace) {
+  const ep = trace.entrypoint;
+  if (ep.type === "http_request") return `${ep.method} ${ep.path}`;
+  if (ep.type === "cli_command") return ep.command;
+  if (ep.type === "test_case") return ep.testName;
+  return trace.traceId;
+}
+function buildHtml({ title, traceJson, bundleJs, bundleCss }) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>TraceGraph \u2014 ${escapeHtml(title)}</title>
+  <meta name="generator" content="tracegraph" />
+${bundleCss ? `  <style>
+${bundleCss}
+  </style>` : ""}
+</head>
+<body>
+  <div id="root"></div>
+  <script id="tracegraph-data" type="application/json">
+${traceJson}
+  </script>
+  <script>
+${bundleJs}
+  </script>
+</body>
+</html>`;
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function resolveOutPath(traceFilePath, out, traceId) {
+  if (out) return import_path5.default.resolve(process.cwd(), out);
+  const tracegraphDir = findTracegraphDir(traceFilePath);
+  return import_path5.default.join(tracegraphDir, "reports", `${traceId}.html`);
+}
+function findTracegraphDir(traceFilePath) {
+  let dir = import_path5.default.dirname(traceFilePath);
+  while (true) {
+    if (import_path5.default.basename(dir) === ".tracegraph") return dir;
+    const parent = import_path5.default.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return import_path5.default.dirname(traceFilePath);
+}
+function openInBrowser(filePath) {
+  const url = `file://${filePath}`;
+  try {
+    const { execSync } = require("child_process");
+    if (process.platform === "win32") {
+      execSync(`start "" "${filePath}"`, { stdio: "ignore" });
+    } else if (process.platform === "darwin") {
+      execSync(`open "${filePath}"`, { stdio: "ignore" });
+    } else {
+      execSync(`xdg-open "${filePath}"`, { stdio: "ignore" });
+    }
+  } catch {
+    process.stdout.write(`[tracegraph] Open in browser: ${url}
+`);
+  }
+}
+
+// src/commands/init.ts
+var import_fs4 = __toESM(require("fs"));
+var import_path6 = __toESM(require("path"));
+function initCommand() {
+  const cwd = process.cwd();
+  const pm = detectPackageManager(cwd);
+  const testRunner = detectTestRunner(cwd);
+  const framework = detectFramework(cwd);
+  process.stdout.write("[tracegraph] Initialising project...\n\n");
+  addPackageJsonScripts(cwd, pm, testRunner);
+  createConfig(cwd, framework);
+  updateGitignore(cwd);
+  process.stdout.write("\n[tracegraph] Done! Next steps:\n\n");
+  process.stdout.write(`  1. Install the adapter:  ${pm} add -D @tracegraph/trace-js
+`);
+  process.stdout.write(`  2. Add middleware:        app.use(traceExpress())  // before routes
+`);
+  process.stdout.write(`  3. Run a trace:          ${pm} run trace:test
+`);
+  process.stdout.write(`  4. View the graph:       ${pm} run trace:report
+
+`);
+}
+function detectPackageManager(cwd) {
+  if (import_fs4.default.existsSync(import_path6.default.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (import_fs4.default.existsSync(import_path6.default.join(cwd, "yarn.lock"))) return "yarn";
+  if (import_fs4.default.existsSync(import_path6.default.join(cwd, "bun.lockb"))) return "bun";
+  return "npm";
+}
+function detectTestRunner(cwd) {
+  try {
+    const pkg = JSON.parse(import_fs4.default.readFileSync(import_path6.default.join(cwd, "package.json"), "utf8"));
+    const all = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    if ("vitest" in all) return "vitest run";
+    if ("jest" in all) return "jest";
+    if ("playwright" in all) return "playwright test";
+    if ("mocha" in all) return "mocha";
+  } catch {
+  }
+  return "test";
+}
+function detectFramework(cwd) {
+  try {
+    const pkg = JSON.parse(import_fs4.default.readFileSync(import_path6.default.join(cwd, "package.json"), "utf8"));
+    const deps = pkg.dependencies ?? {};
+    if ("express" in deps) return "express";
+    if ("fastify" in deps) return "fastify";
+    if ("next" in deps) return "nextjs";
+    if ("@nestjs/core" in deps) return "nestjs";
+  } catch {
+  }
+  return "plain";
+}
+function addPackageJsonScripts(cwd, pm, testRunner) {
+  const pkgPath = import_path6.default.join(cwd, "package.json");
+  if (!import_fs4.default.existsSync(pkgPath)) {
+    process.stderr.write("[tracegraph] No package.json found \u2014 skipping script injection\n");
+    return;
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(import_fs4.default.readFileSync(pkgPath, "utf8"));
+  } catch {
+    process.stderr.write("[tracegraph] Failed to parse package.json \u2014 skipping script injection\n");
+    return;
+  }
+  const scripts = pkg.scripts ?? {};
+  const added = [];
+  const newScripts = {
+    "trace:test": `tracegraph run -- ${pm} run ${testRunner}`,
+    "trace:baseline": "tracegraph baseline create",
+    "trace:compare": "tracegraph compare",
+    "trace:report": "tracegraph open --html .tracegraph/reports/latest.report.json"
+  };
+  for (const [key, value] of Object.entries(newScripts)) {
+    if (!scripts[key]) {
+      scripts[key] = value;
+      added.push(key);
+    } else {
+      process.stdout.write(`  [skip] ${key} already exists in package.json
+`);
+    }
+  }
+  pkg.scripts = scripts;
+  import_fs4.default.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+  if (added.length > 0) {
+    process.stdout.write(`  [ok] Added scripts to package.json: ${added.join(", ")}
+`);
+  }
+}
+function createConfig(cwd, framework) {
+  const configPath = import_path6.default.join(cwd, "tracegraph.config.json");
+  if (import_fs4.default.existsSync(configPath)) {
+    process.stdout.write("  [skip] tracegraph.config.json already exists\n");
+    return;
+  }
+  const config = {
+    language: "typescript",
+    framework,
+    sanitize: {
+      redactKeys: [],
+      maxDepth: 4,
+      maxStringLength: 500,
+      maxArrayLength: 50
+    },
+    storage: {
+      maxRuns: 20,
+      maxAgeDays: 7,
+      maxSizeMB: 500,
+      keepFailedRuns: 50,
+      pruneOnRun: true
+    }
+  };
+  import_fs4.default.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
+  process.stdout.write("  [ok] Created tracegraph.config.json\n");
+}
+var GITIGNORE_ENTRIES = [
+  "# TraceGraph",
+  ".tracegraph/runs/",
+  ".tracegraph/traces/",
+  ".tracegraph/reports/",
+  ".tracegraph/bundles/",
+  ".tracegraph/index.json"
+];
+function updateGitignore(cwd) {
+  const gitignorePath = import_path6.default.join(cwd, ".gitignore");
+  const existing = import_fs4.default.existsSync(gitignorePath) ? import_fs4.default.readFileSync(gitignorePath, "utf8") : "";
+  const toAdd = GITIGNORE_ENTRIES.filter(
+    (entry) => !entry.startsWith("#") && !existing.includes(entry)
+  );
+  if (toAdd.length === 0) {
+    process.stdout.write("  [skip] .gitignore already contains TraceGraph entries\n");
+    return;
+  }
+  const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  const addition = separator + GITIGNORE_ENTRIES.join("\n") + "\n";
+  import_fs4.default.appendFileSync(gitignorePath, addition, "utf8");
+  process.stdout.write("  [ok] Updated .gitignore\n");
+}
+
+// src/commands/baseline.ts
+var import_fs5 = __toESM(require("fs"));
+var import_path7 = __toESM(require("path"));
+var import_shared_types3 = require("@tracegraph/shared-types");
+var import_graph_engine = require("@tracegraph/graph-engine");
+function baselineCreateCommand(options) {
+  const cwd = process.cwd();
+  const tracegraphDir = import_path7.default.join(cwd, ".tracegraph");
+  const tracesDir = import_path7.default.join(tracegraphDir, "traces");
+  const baselinesDir = import_path7.default.join(tracegraphDir, "baselines");
+  if (!import_fs5.default.existsSync(tracesDir)) {
+    process.stderr.write(
+      "[tracegraph] No traces found. Run `tracegraph run -- <your-test-command>` first.\n"
+    );
+    return import_shared_types3.EXIT_CODES.CLI_ERROR;
+  }
+  const traceFiles = resolveTraceFiles(tracesDir, tracegraphDir, options);
+  if (traceFiles.length === 0) {
+    process.stderr.write("[tracegraph] No .trace.json files found for the selected scope.\n");
+    process.stderr.write("  Try: tracegraph baseline create --all-traces\n");
+    return import_shared_types3.EXIT_CODES.CLI_ERROR;
+  }
+  const approvedBy = options.approvedBy ?? process.env["USER"] ?? process.env["USERNAME"] ?? "system";
+  const reason = options.reason ?? "Baseline created by tracegraph CLI";
+  import_fs5.default.mkdirSync(baselinesDir, { recursive: true });
+  let created = 0;
+  let skipped = 0;
+  for (const traceFile of traceFiles) {
+    let session;
+    try {
+      session = JSON.parse(import_fs5.default.readFileSync(traceFile, "utf8"));
+    } catch {
+      process.stderr.write(`[tracegraph] Skipping unreadable trace: ${traceFile}
+`);
+      skipped++;
+      continue;
+    }
+    if (session.schemaVersion !== import_shared_types3.SCHEMA_VERSIONS.trace) {
+      process.stderr.write(
+        `[tracegraph] Schema mismatch in ${import_path7.default.basename(traceFile)} \u2014 expected ${import_shared_types3.SCHEMA_VERSIONS.trace}, got ${session.schemaVersion}
+  Run: tracegraph baseline migrate
+`
+      );
+      skipped++;
+      continue;
+    }
+    const baseline = (0, import_graph_engine.sessionToBaseline)(session, { approvedBy, reason });
+    const outFile = import_path7.default.join(baselinesDir, `${baseline.testId}.baseline.json`);
+    if (import_fs5.default.existsSync(outFile) && !options.all) {
+      const existing = JSON.parse(import_fs5.default.readFileSync(outFile, "utf8"));
+      process.stdout.write(
+        `  [skip] Baseline already exists for testId ${baseline.testId} (approved ${new Date(existing.approvedAt).toISOString().slice(0, 10)}). Use --all to overwrite.
+`
+      );
+      skipped++;
+      continue;
+    }
+    import_fs5.default.writeFileSync(outFile, JSON.stringify(baseline, null, 2) + "\n", "utf8");
+    process.stdout.write(`  [ok] Baseline created: ${import_path7.default.relative(cwd, outFile)}
+`);
+    created++;
+  }
+  process.stdout.write(
+    `
+[tracegraph] baseline create: ${created} created, ${skipped} skipped
+`
+  );
+  return import_shared_types3.EXIT_CODES.SUCCESS;
+}
+function resolveTraceFiles(tracesDir, tracegraphDir, options) {
+  let files;
+  if (options.allTraces) {
+    files = allTraceFiles(tracesDir);
+    process.stdout.write(`[tracegraph] Scoping to ALL ${files.length} trace(s) in .tracegraph/traces/
+`);
+  } else if (options.runId) {
+    const allFiles = allTraceFiles(tracesDir);
+    files = allFiles.filter((f) => {
+      try {
+        const session = JSON.parse(import_fs5.default.readFileSync(f, "utf8"));
+        return session.runId === options.runId;
+      } catch {
+        return false;
+      }
+    });
+    process.stdout.write(
+      `[tracegraph] Scoping to run ${options.runId}: ${files.length} trace(s) found.
+`
+    );
+  } else {
+    const latestPath = import_path7.default.join(tracegraphDir, "latest.json");
+    if (import_fs5.default.existsSync(latestPath)) {
+      try {
+        const ptr = JSON.parse(import_fs5.default.readFileSync(latestPath, "utf8"));
+        const resolved = ptr.latestTraceIds.map((id) => import_path7.default.join(tracesDir, `${id}.trace.json`)).filter((p) => import_fs5.default.existsSync(p));
+        if (resolved.length > 0) {
+          process.stdout.write(
+            `[tracegraph] Scoping to latest run ${ptr.latestRunId} (${resolved.length} trace(s)). Use --all-traces to baseline everything.
+`
+          );
+          files = resolved;
+        } else {
+          process.stderr.write(
+            "[tracegraph] latest.json found but no matching trace files \u2014 falling back to all traces.\n"
+          );
+          files = allTraceFiles(tracesDir);
+        }
+      } catch {
+        files = allTraceFiles(tracesDir);
+      }
+    } else {
+      process.stderr.write(
+        "[tracegraph] .tracegraph/latest.json not found. Baseline will include ALL traces in .tracegraph/traces/.\n  Run `tracegraph run -- <command>` first to create a latest.json pointer.\n"
+      );
+      files = allTraceFiles(tracesDir);
+    }
+  }
+  if (options.onlyPassed) {
+    const before = files.length;
+    files = files.filter((f) => {
+      try {
+        const session = JSON.parse(import_fs5.default.readFileSync(f, "utf8"));
+        return session.status === "passed";
+      } catch {
+        return false;
+      }
+    });
+    const skipped = before - files.length;
+    if (skipped > 0) {
+      process.stdout.write(`[tracegraph] --only-passed: skipped ${skipped} non-passing trace(s).
+`);
+    }
+  }
+  return files;
+}
+function allTraceFiles(tracesDir) {
+  return import_fs5.default.readdirSync(tracesDir).filter((f) => f.endsWith(".trace.json")).map((f) => import_path7.default.join(tracesDir, f));
+}
+function baselineListCommand() {
+  const cwd = process.cwd();
+  const baselinesDir = import_path7.default.join(cwd, ".tracegraph", "baselines");
+  if (!import_fs5.default.existsSync(baselinesDir)) {
+    process.stdout.write("[tracegraph] No baselines found. Run `tracegraph baseline create` first.\n");
+    return import_shared_types3.EXIT_CODES.SUCCESS;
+  }
+  const files = import_fs5.default.readdirSync(baselinesDir).filter((f) => f.endsWith(".baseline.json"));
+  if (files.length === 0) {
+    process.stdout.write("[tracegraph] No baselines found.\n");
+    return import_shared_types3.EXIT_CODES.SUCCESS;
+  }
+  process.stdout.write(
+    ["testId".padEnd(16), "events".padEnd(8), "captureLevel".padEnd(14), "approvedBy".padEnd(16), "approvedAt"].join(" | ") + "\n"
+  );
+  process.stdout.write("\u2500".repeat(72) + "\n");
+  for (const file of files) {
+    try {
+      const b = JSON.parse(
+        import_fs5.default.readFileSync(import_path7.default.join(baselinesDir, file), "utf8")
+      );
+      const row = [
+        b.testId.slice(0, 14).padEnd(16),
+        String(b.events.length).padEnd(8),
+        String(b.captureLevel).padEnd(14),
+        (b.approvedBy ?? "unknown").slice(0, 14).padEnd(16),
+        new Date(b.approvedAt).toISOString().slice(0, 10)
+      ];
+      process.stdout.write(row.join(" | ") + "\n");
+    } catch {
+      process.stderr.write(`  [warn] Could not read ${file}
+`);
+    }
+  }
+  return import_shared_types3.EXIT_CODES.SUCCESS;
+}
+function baselineApproveCommand(baselineIdOrTestId, options) {
+  const cwd = process.cwd();
+  const baselinesDir = import_path7.default.join(cwd, ".tracegraph", "baselines");
+  if (!import_fs5.default.existsSync(baselinesDir)) {
+    process.stderr.write("[tracegraph] No baselines directory found.\n");
+    return import_shared_types3.EXIT_CODES.CLI_ERROR;
+  }
+  const files = import_fs5.default.readdirSync(baselinesDir).filter((f) => f.endsWith(".baseline.json"));
+  let found = null;
+  for (const file of files) {
+    if (file.startsWith(baselineIdOrTestId)) {
+      found = import_path7.default.join(baselinesDir, file);
+      break;
+    }
+    try {
+      const b = JSON.parse(import_fs5.default.readFileSync(import_path7.default.join(baselinesDir, file), "utf8"));
+      if (b.baselineId === baselineIdOrTestId || b.testId === baselineIdOrTestId) {
+        found = import_path7.default.join(baselinesDir, file);
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!found) {
+    process.stderr.write(`[tracegraph] Baseline not found: ${baselineIdOrTestId}
+`);
+    return import_shared_types3.EXIT_CODES.CLI_ERROR;
+  }
+  const baseline = JSON.parse(import_fs5.default.readFileSync(found, "utf8"));
+  baseline.approvedBy = options.approvedBy ?? process.env["USER"] ?? process.env["USERNAME"] ?? "system";
+  baseline.reason = options.reason;
+  baseline.approvedAt = Date.now();
+  import_fs5.default.writeFileSync(found, JSON.stringify(baseline, null, 2) + "\n", "utf8");
+  process.stdout.write(`[tracegraph] Baseline approved: ${import_path7.default.relative(cwd, found)}
+`);
+  return import_shared_types3.EXIT_CODES.SUCCESS;
+}
+function findBaselineForSession(baselinesDir, session) {
+  const testId = (0, import_graph_engine.deriveTestId)(session.entrypoint);
+  const file = import_path7.default.join(baselinesDir, `${testId}.baseline.json`);
+  if (!import_fs5.default.existsSync(file)) return null;
+  try {
+    return JSON.parse(import_fs5.default.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/compare.ts
+var import_fs6 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
+var import_node_crypto = require("crypto");
+var import_shared_types4 = require("@tracegraph/shared-types");
+var import_graph_engine2 = require("@tracegraph/graph-engine");
+function compareCommand(options) {
+  const cwd = process.cwd();
+  const tracegraphDir = import_path8.default.join(cwd, ".tracegraph");
+  const baselinesDir = options.baseline ? import_path8.default.resolve(cwd, options.baseline) : import_path8.default.join(tracegraphDir, "baselines");
+  const candidateFiles = options.bundle ? resolveBundleTraceFiles(options.bundle, tracegraphDir, cwd) : resolveCandidateFiles(options.candidate, tracegraphDir, cwd, options.latest);
+  if (candidateFiles.length === 0) {
+    process.stderr.write(
+      "[tracegraph] No candidate traces found. Run `tracegraph run -- <command>` first, or specify --candidate.\n"
+    );
+    return import_shared_types4.EXIT_CODES.CLI_ERROR;
+  }
+  const suppressions = loadSuppressions(tracegraphDir);
+  const approvals = loadApprovals(tracegraphDir);
+  const diffs = [];
+  const allEvaluated = [];
+  let tracesCompared = 0;
+  for (const candidateFile of candidateFiles) {
+    let session;
+    try {
+      session = JSON.parse(import_fs6.default.readFileSync(candidateFile, "utf8"));
+    } catch (err) {
+      process.stderr.write(`[tracegraph] Skipping unreadable trace: ${candidateFile}
+`);
+      continue;
+    }
+    if (session.schemaVersion !== import_shared_types4.SCHEMA_VERSIONS.trace) {
+      process.stderr.write(
+        `[tracegraph] Schema mismatch: ${import_path8.default.basename(candidateFile)} \u2014 expected ${import_shared_types4.SCHEMA_VERSIONS.trace}, got ${session.schemaVersion}
+`
+      );
+      continue;
+    }
+    const baseline = findBaselineForSession(baselinesDir, session);
+    if (!baseline) {
+      process.stderr.write(
+        `[tracegraph] No baseline found for trace ${session.traceId} \u2014 skipping comparison.
+  Run: tracegraph baseline create
+`
+      );
+      continue;
+    }
+    tracesCompared++;
+    const diff = (0, import_graph_engine2.diffBaseline)(baseline, session);
+    diffs.push(diff);
+    const rawFindings = [
+      ...(0, import_graph_engine2.diffToFindings)(diff),
+      ...(0, import_graph_engine2.analyseTraceFindings)(session)
+    ];
+    const evaluated = (0, import_graph_engine2.evaluateFindings)(rawFindings, session, suppressions, approvals);
+    allEvaluated.push(...evaluated);
+    for (const f of evaluated.filter((e) => e.status === "open")) {
+      emit({
+        type: "finding",
+        runId: session.runId,
+        payload: {
+          fingerprint: f.fingerprint,
+          ruleId: f.ruleId,
+          severity: f.severity,
+          title: f.title
+        }
+      });
+    }
+  }
+  const suppressionsModified = checkSuppressionsFileModified(tracegraphDir);
+  if (suppressionsModified) {
+    const policyFinding = buildSuppressionsModifiedFinding();
+    allEvaluated.push({ ...policyFinding, status: "open" });
+  }
+  const findingsBySeverity = {
+    critical: 0,
+    high: 0,
+    medium: 0,
+    low: 0,
+    info: 0
+  };
+  for (const f of allEvaluated) {
+    if (f.status === "open") {
+      findingsBySeverity[f.severity] = (findingsBySeverity[f.severity] ?? 0) + 1;
+    }
+  }
+  const hasOpenCritical = (findingsBySeverity.critical ?? 0) > 0;
+  const report = {
+    schemaVersion: import_shared_types4.SCHEMA_VERSIONS.report,
+    reportId: `report_${(0, import_node_crypto.createHash)("sha256").update(Date.now().toString()).digest("hex").slice(0, 12)}`,
+    createdAt: Date.now(),
+    baselineDir: import_path8.default.relative(cwd, baselinesDir),
+    candidateFiles: candidateFiles.map((f) => import_path8.default.relative(cwd, f)),
+    diffs,
+    findings: allEvaluated,
+    summary: {
+      tracesCompared,
+      findingsBySeverity,
+      hasOpenCritical,
+      suppressionsModified
+    }
+  };
+  const outPath = resolveOutPath2(options.out, tracegraphDir, report.reportId, cwd);
+  import_fs6.default.mkdirSync(import_path8.default.dirname(outPath), { recursive: true });
+  import_fs6.default.writeFileSync(outPath, JSON.stringify(report, null, 2) + "\n", "utf8");
+  process.stdout.write(`[tracegraph] Report: ${import_path8.default.relative(cwd, outPath)}
+`);
+  const openCount = allEvaluated.filter((f) => f.status === "open").length;
+  if (openCount > 0) {
+    process.stdout.write(
+      `[tracegraph] ${openCount} open finding(s): ` + SEVERITY_ORDER.filter((s) => (findingsBySeverity[s] ?? 0) > 0).map((s) => `${findingsBySeverity[s]} ${s}`).join(", ") + "\n"
+    );
+  } else {
+    process.stdout.write("[tracegraph] No open findings.\n");
+  }
+  emit({
+    type: "report.created",
+    runId: `compare_${Date.now()}`,
+    payload: {
+      file: import_path8.default.relative(cwd, outPath),
+      openFindings: openCount,
+      hasOpenCritical
+    }
+  });
+  updateLatestReport(tracegraphDir, report.reportId);
+  if (suppressionsModified) return import_shared_types4.EXIT_CODES.POLICY_REVIEW;
+  if (hasOpenCritical && options.failOnCritical) return import_shared_types4.EXIT_CODES.FINDINGS_THRESHOLD;
+  return import_shared_types4.EXIT_CODES.SUCCESS;
+}
+var SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
+function updateLatestReport(tracegraphDir, reportId) {
+  const latestPath = import_path8.default.join(tracegraphDir, "latest.json");
+  try {
+    let existing = {
+      latestRunId: "",
+      latestTraceIds: [],
+      latestReportId: null,
+      updatedAt: Date.now()
+    };
+    if (import_fs6.default.existsSync(latestPath)) {
+      existing = JSON.parse(import_fs6.default.readFileSync(latestPath, "utf8"));
+    }
+    existing.latestReportId = reportId;
+    existing.updatedAt = Date.now();
+    import_fs6.default.writeFileSync(latestPath, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  } catch {
+  }
+}
+function resolveBundleTraceFiles(bundleArg, tracegraphDir, cwd) {
+  const abs = import_path8.default.resolve(cwd, bundleArg);
+  if (!import_fs6.default.existsSync(abs)) {
+    process.stderr.write(`[tracegraph] Bundle file not found: ${abs}
+`);
+    return [];
+  }
+  let bundle;
+  try {
+    bundle = JSON.parse(import_fs6.default.readFileSync(abs, "utf8"));
+  } catch (err) {
+    process.stderr.write(`[tracegraph] Cannot parse bundle file: ${abs} \u2014 ${String(err)}
+`);
+    return [];
+  }
+  if (!Array.isArray(bundle.traces)) {
+    process.stderr.write(`[tracegraph] Bundle has no traces array: ${abs}
+`);
+    return [];
+  }
+  const resolved = [];
+  for (const entry of bundle.traces) {
+    const tracePath = import_path8.default.join(tracegraphDir, entry.file);
+    if (import_fs6.default.existsSync(tracePath)) {
+      resolved.push(tracePath);
+    } else {
+      process.stderr.write(
+        `[tracegraph] Bundle trace file not found, skipping: ${entry.file}
+`
+      );
+    }
+  }
+  if (resolved.length > 0) {
+    process.stderr.write(
+      `[tracegraph] Bundle "${bundle.scenarioId}" \u2014 ${resolved.length}/${bundle.traces.length} trace(s) resolved.
+`
+    );
+  }
+  return resolved;
+}
+function resolveCandidateFiles(candidateArg, tracegraphDir, cwd, useLatest) {
+  if (candidateArg) {
+    const abs = import_path8.default.resolve(cwd, candidateArg);
+    if (!import_fs6.default.existsSync(abs)) return [];
+    if (import_fs6.default.statSync(abs).isDirectory()) {
+      return import_fs6.default.readdirSync(abs).filter((f) => f.endsWith(".trace.json")).map((f) => import_path8.default.join(abs, f));
+    }
+    return [abs];
+  }
+  const tracesDir = import_path8.default.join(tracegraphDir, "traces");
+  if (useLatest || !candidateArg) {
+    const latestPath = import_path8.default.join(tracegraphDir, "latest.json");
+    if (import_fs6.default.existsSync(latestPath)) {
+      try {
+        const ptr = JSON.parse(import_fs6.default.readFileSync(latestPath, "utf8"));
+        const resolved = ptr.latestTraceIds.map((id) => import_path8.default.join(tracesDir, `${id}.trace.json`)).filter((p) => import_fs6.default.existsSync(p));
+        if (resolved.length > 0) {
+          process.stderr.write(
+            `[tracegraph] Using latest run ${ptr.latestRunId} (${resolved.length} trace(s)).
+  Pass --candidate <dir> to compare a different set.
+`
+          );
+          return resolved;
+        }
+      } catch {
+      }
+    }
+  }
+  if (!import_fs6.default.existsSync(tracesDir)) return [];
+  return import_fs6.default.readdirSync(tracesDir).filter((f) => f.endsWith(".trace.json")).map((f) => import_path8.default.join(tracesDir, f));
+}
+function loadSuppressions(tracegraphDir) {
+  const suppressionFile = import_path8.default.join(tracegraphDir, "suppressions", "tracegraph.suppressions.json");
+  if (!import_fs6.default.existsSync(suppressionFile)) return [];
+  try {
+    const data = JSON.parse(import_fs6.default.readFileSync(suppressionFile, "utf8"));
+    return data.suppressions ?? [];
+  } catch {
+    return [];
+  }
+}
+function loadApprovals(tracegraphDir) {
+  const approvalFile = import_path8.default.join(tracegraphDir, "approvals", "findings.json");
+  if (!import_fs6.default.existsSync(approvalFile)) return [];
+  try {
+    const data = JSON.parse(import_fs6.default.readFileSync(approvalFile, "utf8"));
+    return data.approvals ?? [];
+  } catch {
+    return [];
+  }
+}
+function checkSuppressionsFileModified(tracegraphDir) {
+  const suppressionFile = import_path8.default.join(
+    tracegraphDir,
+    "suppressions",
+    "tracegraph.suppressions.json"
+  );
+  if (!import_fs6.default.existsSync(suppressionFile)) return false;
+  try {
+    const { spawnSync: spawnSync2 } = require("child_process");
+    const result = spawnSync2(
+      "git",
+      ["status", "--porcelain", suppressionFile],
+      { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+    );
+    if (result.error || result.status !== 0) return false;
+    return (result.stdout ?? "").trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+function resolveOutPath2(outArg, tracegraphDir, reportId, cwd) {
+  if (outArg) return import_path8.default.resolve(cwd, outArg);
+  return import_path8.default.join(tracegraphDir, "reports", `${reportId}.report.json`);
+}
+function buildSuppressionsModifiedFinding() {
+  const ruleId = "policy.suppressions_modified";
+  const fingerprint = (0, import_node_crypto.createHash)("sha256").update(`${ruleId}:tracegraph.suppressions.json`).digest("hex").slice(0, 16);
+  return {
+    id: `find_${fingerprint}`,
+    fingerprint,
+    ruleId,
+    severity: "high",
+    category: "tracegraph_policy_change",
+    title: "Suppressions file modified in this change",
+    description: "The file .tracegraph/suppressions/tracegraph.suppressions.json has uncommitted changes. Modifications to the suppressions file alter which findings are silenced, which is a policy-level change that requires explicit human review.",
+    evidence: [{ traceId: "policy", eventIds: [] }],
+    recommendation: "Commit and review the suppressions change separately, or revert it if unintentional. Suppressions should be version-controlled and reviewed like code."
+  };
+}
+
+// src/commands/finding.ts
+var import_fs7 = __toESM(require("fs"));
+var import_path9 = __toESM(require("path"));
+var import_shared_types5 = require("@tracegraph/shared-types");
+var import_node_crypto2 = require("crypto");
+var SEVERITY_EMOJI = {
+  critical: "\u{1F534}",
+  high: "\u{1F7E0}",
+  medium: "\u{1F7E1}",
+  low: "\u{1F535}",
+  info: "\u26AA"
+};
+var SEVERITY_ORDER2 = ["critical", "high", "medium", "low", "info"];
+var STATUS_ICON = {
+  open: "\u25CF",
+  approved: "\u2713",
+  suppressed: "\u25CB"
+};
+function findingListCommand(reportArg) {
+  const cwd = process.cwd();
+  const report = loadReport(reportArg, cwd);
+  if (!report) {
+    process.stderr.write(
+      "[tracegraph] No report found. Run `tracegraph compare` first.\n"
+    );
+    return import_shared_types5.EXIT_CODES.CLI_ERROR;
+  }
+  const findings = report.findings;
+  if (findings.length === 0) {
+    process.stdout.write("[tracegraph] No findings.\n");
+    return import_shared_types5.EXIT_CODES.SUCCESS;
+  }
+  process.stdout.write(`
+Findings \u2014 ${new Date(report.createdAt).toISOString().slice(0, 16)}
+
+`);
+  for (const sev of SEVERITY_ORDER2) {
+    const group = findings.filter((f) => f.severity === sev);
+    if (group.length === 0) continue;
+    for (const f of group) {
+      const icon = STATUS_ICON[f.status] ?? "?";
+      process.stdout.write(
+        `  ${SEVERITY_EMOJI[sev]} ${icon} ${f.title}
+     rule: ${f.ruleId} | fingerprint: ${f.fingerprint} | status: ${f.status}
+
+`
+      );
+    }
+  }
+  return import_shared_types5.EXIT_CODES.SUCCESS;
+}
+function findingApproveCommand(fingerprint, options) {
+  const cwd = process.cwd();
+  const tracegraphDir = import_path9.default.join(cwd, ".tracegraph");
+  const report = loadReport(void 0, cwd);
+  let ruleId = "unknown";
+  if (report) {
+    const f = report.findings.find((f2) => f2.fingerprint === fingerprint || f2.id === fingerprint);
+    if (f) ruleId = f.ruleId;
+    else {
+      process.stderr.write(`[tracegraph] Finding not found in latest report: ${fingerprint}
+`);
+      return import_shared_types5.EXIT_CODES.CLI_ERROR;
+    }
+  }
+  const approval = {
+    findingFingerprint: fingerprint,
+    ruleId,
+    semanticTarget: {},
+    approvedBy: options.approvedBy ?? process.env["USER"] ?? process.env["USERNAME"] ?? "system",
+    reason: options.reason,
+    expiresAt: options.expiresAt ?? oneYearFromNow(),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const approvalDir = import_path9.default.join(tracegraphDir, "approvals");
+  const approvalFile = import_path9.default.join(approvalDir, "findings.json");
+  import_fs7.default.mkdirSync(approvalDir, { recursive: true });
+  let existing = {
+    schemaVersion: import_shared_types5.SCHEMA_VERSIONS.findingApproval,
+    approvals: []
+  };
+  if (import_fs7.default.existsSync(approvalFile)) {
+    try {
+      existing = JSON.parse(import_fs7.default.readFileSync(approvalFile, "utf8"));
+    } catch {
+    }
+  }
+  existing.approvals = existing.approvals.filter(
+    (a) => a.findingFingerprint !== fingerprint
+  );
+  existing.approvals.push(approval);
+  import_fs7.default.writeFileSync(approvalFile, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  process.stdout.write(`[tracegraph] Finding approved: ${fingerprint}
+`);
+  return import_shared_types5.EXIT_CODES.SUCCESS;
+}
+function findingSuppressCommand(fingerprint, options) {
+  const cwd = process.cwd();
+  const tracegraphDir = import_path9.default.join(cwd, ".tracegraph");
+  const report = loadReport(void 0, cwd);
+  let ruleId = "unknown";
+  if (report) {
+    const f = report.findings.find((f2) => f2.fingerprint === fingerprint || f2.id === fingerprint);
+    if (f) ruleId = f.ruleId;
+    else {
+      process.stderr.write(`[tracegraph] Finding not found in latest report: ${fingerprint}
+`);
+      return import_shared_types5.EXIT_CODES.CLI_ERROR;
+    }
+  }
+  const requiresEvidence = options.requiresEvidence ? options.requiresEvidence.split(",").map((item) => {
+    const [type, ...rest] = item.trim().split(":");
+    return { type: type ?? "", name: rest.join(":") || "*" };
+  }) : void 0;
+  const suppression = {
+    id: `suppress_${(0, import_node_crypto2.createHash)("sha256").update(fingerprint + Date.now()).digest("hex").slice(0, 12)}`,
+    ruleId,
+    semanticTarget: {},
+    requiresEvidence,
+    reason: options.reason,
+    expiresAt: options.expiresAt ?? oneYearFromNow(),
+    approvedBy: options.approvedBy ?? process.env["USER"] ?? process.env["USERNAME"] ?? "system",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const suppressDir = import_path9.default.join(tracegraphDir, "suppressions");
+  const suppressFile = import_path9.default.join(suppressDir, "tracegraph.suppressions.json");
+  import_fs7.default.mkdirSync(suppressDir, { recursive: true });
+  let existing = {
+    schemaVersion: import_shared_types5.SCHEMA_VERSIONS.suppression,
+    suppressions: []
+  };
+  if (import_fs7.default.existsSync(suppressFile)) {
+    try {
+      existing = JSON.parse(import_fs7.default.readFileSync(suppressFile, "utf8"));
+    } catch {
+    }
+  }
+  existing.suppressions.push(suppression);
+  import_fs7.default.writeFileSync(suppressFile, JSON.stringify(existing, null, 2) + "\n", "utf8");
+  process.stdout.write(`[tracegraph] Suppression added for finding ${fingerprint}
+`);
+  if (requiresEvidence) {
+    process.stdout.write(
+      `  requiresEvidence: ${requiresEvidence.map((e) => `${e.type}:${e.name}`).join(", ")}
+`
+    );
+  }
+  return import_shared_types5.EXIT_CODES.SUCCESS;
+}
+function loadReport(reportArg, cwd) {
+  const tracegraphDir = import_path9.default.join(cwd, ".tracegraph");
+  let reportFile;
+  if (reportArg) {
+    reportFile = import_path9.default.resolve(cwd, reportArg);
+  } else {
+    const reportsDir = import_path9.default.join(tracegraphDir, "reports");
+    if (!import_fs7.default.existsSync(reportsDir)) return null;
+    const files = import_fs7.default.readdirSync(reportsDir).filter((f) => f.endsWith(".report.json")).map((f) => ({
+      name: f,
+      mtime: import_fs7.default.statSync(import_path9.default.join(reportsDir, f)).mtimeMs
+    })).sort((a, b) => b.mtime - a.mtime);
+    if (files.length === 0) return null;
+    reportFile = import_path9.default.join(reportsDir, files[0].name);
+  }
+  if (!import_fs7.default.existsSync(reportFile)) return null;
+  try {
+    return JSON.parse(import_fs7.default.readFileSync(reportFile, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function oneYearFromNow() {
+  const d = /* @__PURE__ */ new Date();
+  d.setFullYear(d.getFullYear() + 1);
+  return d.toISOString();
+}
+
+// src/commands/explain.ts
+var import_fs8 = __toESM(require("fs"));
+var import_path10 = __toESM(require("path"));
+var import_shared_types6 = require("@tracegraph/shared-types");
+var SEVERITY_EMOJI2 = {
+  critical: "\u{1F534}",
+  high: "\u{1F7E0}",
+  medium: "\u{1F7E1}",
+  low: "\u{1F535}",
+  info: "\u26AA"
+};
+var SEVERITY_LABEL = {
+  critical: "CRITICAL",
+  high: "HIGH",
+  medium: "MEDIUM",
+  low: "LOW",
+  info: "INFO"
+};
+var STATUS_LABEL = {
+  open: "Open",
+  approved: "Approved",
+  suppressed: "Suppressed"
+};
+function findingExplainCommand(fingerprint, options) {
+  const cwd = process.cwd();
+  const report = loadReport2(options.report, cwd);
+  if (!report) {
+    process.stderr.write(
+      "[tracegraph] No report found. Run `tracegraph compare` first.\n"
+    );
+    return import_shared_types6.EXIT_CODES.CLI_ERROR;
+  }
+  const finding = report.findings.find(
+    (f) => f.fingerprint === fingerprint || f.id === fingerprint || f.fingerprint.startsWith(fingerprint)
+  );
+  if (!finding) {
+    process.stderr.write(
+      `[tracegraph] Finding not found in report: ${fingerprint}
+  Run \`tracegraph finding list\` to see all fingerprints.
+`
+    );
+    return import_shared_types6.EXIT_CODES.CLI_ERROR;
+  }
+  if (options.json) {
+    process.stdout.write(JSON.stringify(finding, null, 2) + "\n");
+    return import_shared_types6.EXIT_CODES.SUCCESS;
+  }
+  process.stdout.write(renderFindingExplanation(finding));
+  return import_shared_types6.EXIT_CODES.SUCCESS;
+}
+function renderFindingExplanation(f) {
+  const sev = SEVERITY_LABEL[f.severity] ?? f.severity.toUpperCase();
+  const emoji = SEVERITY_EMOJI2[f.severity] ?? "";
+  const status = STATUS_LABEL[f.status] ?? f.status;
+  const divider = "\u2500".repeat(64);
+  const lines = [];
+  lines.push("");
+  lines.push(`${emoji}  ${f.title}`);
+  lines.push(divider);
+  lines.push(`  Rule:        ${f.ruleId}`);
+  lines.push(`  Fingerprint: ${f.fingerprint}`);
+  lines.push(`  Severity:    ${sev}`);
+  lines.push(`  Category:    ${f.category}`);
+  lines.push(`  Status:      ${status}`);
+  if (f.status === "approved" && f.approvedBy) {
+    lines.push(`  Approved by: ${f.approvedBy}`);
+    if (f.approvedReason) lines.push(`  Reason:      ${f.approvedReason}`);
+  }
+  if (f.status === "suppressed" && f.suppressedBy) {
+    lines.push(`  Suppressed by: ${f.suppressedBy}`);
+  }
+  lines.push("");
+  lines.push("Description:");
+  for (const line of wrapText(f.description, 72)) {
+    lines.push(`  ${line}`);
+  }
+  if (f.recommendation) {
+    lines.push("");
+    lines.push("Recommendation:");
+    for (const line of wrapText(f.recommendation, 72)) {
+      lines.push(`  ${line}`);
+    }
+  }
+  if (f.evidence.length > 0) {
+    lines.push("");
+    lines.push("Evidence:");
+    for (const ev of f.evidence) {
+      lines.push(`  Trace: ${ev.traceId}`);
+      if (ev.eventIds.length > 0) {
+        lines.push(`  Events: ${ev.eventIds.join(", ")}`);
+      } else {
+        lines.push("  Events: (none recorded)");
+      }
+      if (ev.file) {
+        const loc = ev.line ? `${ev.file}:${ev.line}` : ev.file;
+        lines.push(`  File: ${loc}`);
+      }
+    }
+  }
+  lines.push("");
+  if (f.status === "open") {
+    lines.push("Actions:");
+    lines.push(`  tracegraph finding approve ${f.fingerprint} --reason "..."`);
+    lines.push(`  tracegraph finding suppress ${f.fingerprint} --reason "..."`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function loadReport2(reportArg, cwd) {
+  const tracegraphDir = import_path10.default.join(cwd, ".tracegraph");
+  let reportFile;
+  if (reportArg) {
+    reportFile = import_path10.default.resolve(cwd, reportArg);
+  } else {
+    const reportsDir = import_path10.default.join(tracegraphDir, "reports");
+    if (!import_fs8.default.existsSync(reportsDir)) return null;
+    const files = import_fs8.default.readdirSync(reportsDir).filter((f) => f.endsWith(".report.json")).map((f) => ({ name: f, mtime: import_fs8.default.statSync(import_path10.default.join(reportsDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+    if (files.length === 0) return null;
+    reportFile = import_path10.default.join(reportsDir, files[0].name);
+  }
+  if (!import_fs8.default.existsSync(reportFile)) return null;
+  try {
+    return JSON.parse(import_fs8.default.readFileSync(reportFile, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function wrapText(text, maxWidth) {
+  const words = text.split(/\s+/);
+  const lines = [];
+  let current = "";
+  for (const word of words) {
+    if (!word) continue;
+    if (current.length === 0) {
+      current = word;
+    } else if (current.length + 1 + word.length <= maxWidth) {
+      current += " " + word;
+    } else {
+      lines.push(current);
+      current = word;
+    }
+  }
+  if (current) lines.push(current);
+  return lines.length > 0 ? lines : [""];
+}
+
+// src/commands/report.ts
+var import_fs9 = __toESM(require("fs"));
+var import_path11 = __toESM(require("path"));
+var import_shared_types7 = require("@tracegraph/shared-types");
+var import_ci_reporter = require("@tracegraph/ci-reporter");
+function reportCommand(options) {
+  const cwd = process.cwd();
+  const tracegraphDir = import_path11.default.join(cwd, ".tracegraph");
+  let reportFile;
+  if (options.input) {
+    reportFile = import_path11.default.resolve(cwd, options.input);
+  } else {
+    const reportsDir = import_path11.default.join(tracegraphDir, "reports");
+    if (!import_fs9.default.existsSync(reportsDir)) {
+      process.stderr.write(
+        "[tracegraph] No reports found. Run `tracegraph compare` first.\n"
+      );
+      return import_shared_types7.EXIT_CODES.CLI_ERROR;
+    }
+    const files = import_fs9.default.readdirSync(reportsDir).filter((f) => f.endsWith(".report.json")).map((f) => ({
+      name: f,
+      mtime: import_fs9.default.statSync(import_path11.default.join(reportsDir, f)).mtimeMs
+    })).sort((a, b) => b.mtime - a.mtime);
+    if (files.length === 0) {
+      process.stderr.write("[tracegraph] No .report.json files found.\n");
+      return import_shared_types7.EXIT_CODES.CLI_ERROR;
+    }
+    reportFile = import_path11.default.join(reportsDir, files[0].name);
+  }
+  if (!import_fs9.default.existsSync(reportFile)) {
+    process.stderr.write(`[tracegraph] Report file not found: ${reportFile}
+`);
+    return import_shared_types7.EXIT_CODES.CLI_ERROR;
+  }
+  let report;
+  try {
+    report = JSON.parse(import_fs9.default.readFileSync(reportFile, "utf8"));
+  } catch (err) {
+    process.stderr.write(`[tracegraph] Failed to read report: ${String(err)}
+`);
+    return import_shared_types7.EXIT_CODES.CLI_ERROR;
+  }
+  const format = options.format ?? "markdown";
+  const rendered = (0, import_ci_reporter.renderReport)(report, {
+    format,
+    projectName: options.projectName
+  });
+  if (options.out) {
+    const outPath = import_path11.default.resolve(cwd, options.out);
+    import_fs9.default.mkdirSync(import_path11.default.dirname(outPath), { recursive: true });
+    import_fs9.default.writeFileSync(outPath, rendered, "utf8");
+    process.stdout.write(`[tracegraph] Report written: ${import_path11.default.relative(cwd, outPath)}
+`);
+    if (format === "github-step-summary" && process.env["GITHUB_STEP_SUMMARY"]) {
+      import_fs9.default.appendFileSync(process.env["GITHUB_STEP_SUMMARY"], rendered, "utf8");
+    }
+  } else {
+    process.stdout.write(rendered);
+  }
+  return import_shared_types7.EXIT_CODES.SUCCESS;
+}
+
+// src/commands/diagnose.ts
+var import_fs10 = __toESM(require("fs"));
+var import_path12 = __toESM(require("path"));
+var import_trace_core5 = require("@tracegraph/trace-core");
+var import_shared_types8 = require("@tracegraph/shared-types");
+function diagnoseCommand(options) {
+  const workspaceRoot = process.cwd();
+  const tracegraphDir = import_path12.default.join(workspaceRoot, ".tracegraph");
+  const tracesDir = import_path12.default.join(tracegraphDir, "traces");
+  let traceFile;
+  if (options.trace) {
+    if (import_fs10.default.existsSync(options.trace)) {
+      traceFile = options.trace;
+    } else {
+      const candidate = import_path12.default.join(tracesDir, `${options.trace}.trace.json`);
+      if (import_fs10.default.existsSync(candidate)) traceFile = candidate;
+    }
+    if (!traceFile) {
+      process.stderr.write(`[tracegraph diagnose] Trace not found: ${options.trace}
+`);
+      return import_shared_types8.EXIT_CODES.CLI_ERROR;
+    }
+  } else {
+    if (!import_fs10.default.existsSync(tracegraphDir)) {
+      noTracesMessage();
+      return import_shared_types8.EXIT_CODES.SUCCESS;
+    }
+    const index = (0, import_trace_core5.readTraceIndex)(tracegraphDir);
+    if (index.traces.length === 0) {
+      noTracesMessage();
+      return import_shared_types8.EXIT_CODES.SUCCESS;
+    }
+    const latest = [...index.traces].sort((a, b) => b.createdAt - a.createdAt)[0];
+    traceFile = import_path12.default.resolve(workspaceRoot, latest.file);
+  }
+  let session;
+  try {
+    session = (0, import_trace_core5.readTrace)(traceFile);
+  } catch (err) {
+    process.stderr.write(`[tracegraph diagnose] Failed to read trace: ${String(err)}
+`);
+    return import_shared_types8.EXIT_CODES.CLI_ERROR;
+  }
+  if (options.json) {
+    process.stdout.write(JSON.stringify(buildReport(session), null, 2) + "\n");
+    return import_shared_types8.EXIT_CODES.SUCCESS;
+  }
+  printReport(session);
+  return import_shared_types8.EXIT_CODES.SUCCESS;
+}
+function buildReport(session) {
+  const cl = session.captureLevel;
+  const level = cl.overall;
+  const eventTypes = new Set(session.events.map((e) => e.type));
+  const captured = [];
+  const notCaptured = [];
+  if (eventTypes.has("http_request") || eventTypes.has("http_response")) {
+    captured.push("HTTP requests and responses");
+  } else {
+    notCaptured.push("HTTP requests and responses (add traceExpress / TraceMiddleware)");
+  }
+  if (eventTypes.has("db_query")) {
+    captured.push("Database queries (SQL, duration, table, operation)");
+  } else {
+    notCaptured.push("Database queries (enable DB::listen / query logging)");
+  }
+  if (eventTypes.has("auth_check") || eventTypes.has("authorization_check")) {
+    captured.push("Authentication and authorisation checks");
+  } else {
+    notCaptured.push("Auth / Gate checks (add auth listener)");
+  }
+  if (eventTypes.has("external_http_call")) {
+    captured.push("Outbound HTTP calls (observed via undici / fetch)");
+  } else {
+    notCaptured.push("Outbound HTTP calls (add @tracegraph/js fetch tracking)");
+  }
+  if (eventTypes.has("function_call") || eventTypes.has("method_call")) {
+    captured.push("Internal function and method calls");
+  } else {
+    notCaptured.push("Internal function calls (use traceFunction() for critical logic)");
+  }
+  if (eventTypes.has("test_run")) {
+    captured.push("Per-test lifecycle (test_file \u2192 test_suite \u2192 test_run events)");
+  } else {
+    notCaptured.push("Per-test isolation (add @tracegraph/vitest or @tracegraph/jest reporter)");
+  }
+  if (eventTypes.has("queue_event")) {
+    captured.push("Queue job dispatch and lifecycle");
+  } else {
+    notCaptured.push("Queue events (enable queue lifecycle hooks)");
+  }
+  const recommendations = [];
+  const isJsLang = session.language === "javascript";
+  const isPhpLang = session.language === "php";
+  if (level < 5 && !eventTypes.has("test_run")) {
+    if (isJsLang) {
+      const fw = session.framework ?? "vitest";
+      const pkg = fw === "jest" ? "@tracegraph/jest" : "@tracegraph/vitest";
+      const flag = fw === "jest" ? `--reporters=default --reporters=${pkg}` : `--reporter=default --reporter=${pkg}`;
+      recommendations.push({
+        rank: 1,
+        title: `Add ${pkg} reporter \u2192 Level 5 (per-test traces + full structure)`,
+        command: `npm install -D ${pkg}
+       Then add to vitest.config.ts: reporters: ['verbose', new TraceGraphReporter()]
+       Or run: tracegraph run -- npx ${fw} ${flag}`,
+        level: 5
+      });
+    } else if (isPhpLang) {
+      recommendations.push({
+        rank: 1,
+        title: "Add TraceGraphPHPUnitExtension \u2192 Level 1 (per-test lifecycle)",
+        command: 'Add <extension class="Tracegraph\\PhpUnit\\TraceGraphPHPUnitExtension"/> to phpunit.xml',
+        level: 1
+      });
+    }
+  }
+  if (level < 2 && isJsLang && !eventTypes.has("function_call")) {
+    recommendations.push({
+      rank: 2,
+      title: "Use traceFunction() for critical business logic \u2192 Level 2",
+      command: `import { traceFunction } from "@tracegraph/js"
+const traced = traceFunction("InvoiceService.create", createInvoice)`,
+      level: 2
+    });
+  }
+  if (!eventTypes.has("db_query") && isPhpLang) {
+    recommendations.push({
+      rank: 3,
+      title: "Enable DB::listen in TraceServiceProvider for query tracing",
+      command: `// TraceServiceProvider already includes DB::listen when TRACEGRAPH_ENABLED=1
+// Ensure the provider is registered in config/app.php`,
+      level: 3
+    });
+  }
+  if (!eventTypes.has("auth_check") && !eventTypes.has("authorization_check")) {
+    if (isPhpLang) {
+      recommendations.push({
+        rank: 4,
+        title: "Enable Gate::after hook for authorisation tracing",
+        command: `// TraceServiceProvider registers Gate::after automatically when TRACEGRAPH_ENABLED=1`,
+        level: 4
+      });
+    }
+  }
+  return {
+    traceId: session.traceId,
+    captureLevel: { overall: level, label: cl.label },
+    language: session.language,
+    ...session.framework ? { framework: session.framework } : {},
+    captured,
+    notCaptured,
+    recommendations: recommendations.sort((a, b) => a.rank - b.rank)
+  };
+}
+var LINE = "\u2500".repeat(56);
+function printReport(session) {
+  const report = buildReport(session);
+  const cl = report.captureLevel;
+  const lines = [];
+  lines.push("");
+  lines.push("TraceGraph Capture Report");
+  lines.push(LINE);
+  lines.push(`Trace ID:       ${report.traceId}`);
+  lines.push(`Capture level:  ${cl.overall} \u2014 ${cl.label}`);
+  lines.push(`Language:       ${report.language}`);
+  if (report.framework) lines.push(`Framework:      ${report.framework}`);
+  lines.push("");
+  if (report.captured.length > 0) {
+    lines.push("Captured:");
+    for (const item of report.captured) {
+      lines.push(`  \u2713 ${item}`);
+    }
+  }
+  if (report.notCaptured.length > 0) {
+    lines.push("Not captured:");
+    for (const item of report.notCaptured) {
+      lines.push(`  \u2717 ${item}`);
+    }
+  }
+  if (report.recommendations.length > 0) {
+    lines.push("");
+    lines.push("Recommendations:");
+    let i = 1;
+    for (const rec of report.recommendations) {
+      lines.push(`  ${i}. ${rec.title}`);
+      for (const cmdLine of rec.command.split("\n")) {
+        lines.push(`     ${cmdLine}`);
+      }
+      i++;
+    }
+  } else {
+    lines.push("");
+    lines.push("  \u2713 Capture level is optimal \u2014 no recommendations.");
+  }
+  lines.push(LINE);
+  lines.push("");
+  process.stdout.write(lines.join("\n"));
+}
+function noTracesMessage() {
+  process.stdout.write([
+    "",
+    "TraceGraph Capture Report",
+    LINE,
+    "No traces found in .tracegraph/traces/",
+    "",
+    "Run a command with tracing first:",
+    "  tracegraph run -- npm test",
+    "  tracegraph run -- npx vitest",
+    LINE,
+    ""
+  ].join("\n"));
+}
+
+// src/commands/import-xdebug.ts
+var import_fs11 = __toESM(require("fs"));
+var import_path13 = __toESM(require("path"));
+var import_readline = require("readline");
+var import_shared_types9 = require("@tracegraph/shared-types");
+var import_trace_core6 = require("@tracegraph/trace-core");
+var import_trace_xdebug = require("@tracegraph/trace-xdebug");
+async function importXdebugCommand(xtFile, options) {
+  const maxEvents = options.maxEvents ?? 1e4;
+  const cwd = process.cwd();
+  const xtPath = import_path13.default.resolve(cwd, xtFile);
+  if (!import_fs11.default.existsSync(xtPath)) {
+    process.stderr.write(`[tracegraph] Error: Xdebug trace file not found: ${xtPath}
+`);
+    return import_shared_types9.EXIT_CODES.CLI_ERROR;
+  }
+  process.stderr.write(`[tracegraph] Parsing Xdebug trace: ${xtPath}
+`);
+  const rl = (0, import_readline.createInterface)({
+    input: import_fs11.default.createReadStream(xtPath, "utf8"),
+    crlfDelay: Infinity
+  });
+  const xdebugResult = await (0, import_trace_xdebug.parseXdebugStream)(rl);
+  process.stderr.write(
+    `[tracegraph] Parsed ${xdebugResult.entries.length} Xdebug entries.
+`
+  );
+  let semanticEvents = [];
+  if (options.semantic) {
+    const semanticPath = import_path13.default.resolve(cwd, options.semantic);
+    if (!import_fs11.default.existsSync(semanticPath)) {
+      process.stderr.write(`[tracegraph] Warning: semantic JSONL not found: ${semanticPath}
+`);
+    } else {
+      const raw = import_fs11.default.readFileSync(semanticPath, "utf8");
+      for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        try {
+          const parsed = JSON.parse(trimmed);
+          semanticEvents.push(parsed);
+        } catch {
+        }
+      }
+      process.stderr.write(
+        `[tracegraph] Loaded ${semanticEvents.length} semantic events from JSONL.
+`
+      );
+    }
+  }
+  let traceStartMs = Date.now();
+  if (xdebugResult.traceStart) {
+    const parsed = Date.parse(xdebugResult.traceStart);
+    if (!isNaN(parsed)) traceStartMs = parsed;
+  } else {
+    traceStartMs = import_fs11.default.statSync(xtPath).mtimeMs;
+  }
+  const traceId = (0, import_trace_core6.createTraceId)();
+  let allEvents;
+  if (semanticEvents.length > 0) {
+    const merged = (0, import_trace_xdebug.mergeXdebugTrace)(semanticEvents, xdebugResult, traceStartMs);
+    allEvents = (0, import_trace_xdebug.mergedTraceToEvents)(merged, traceId, traceStartMs);
+    process.stderr.write(
+      `[tracegraph] Correlation: ${merged.correlationStats.markerMatched} marker-matched, ${merged.correlationStats.timestampMatched} timestamp-matched, ${merged.correlationStats.unmatched} unmatched.
+`
+    );
+  } else {
+    allEvents = buildEventsFromXdebug(xdebugResult.entries, traceId, traceStartMs);
+  }
+  if (options.include) {
+    const includeFilter = options.include;
+    const before = allEvents.length;
+    allEvents = allEvents.filter((e) => {
+      if (!e.file) return true;
+      return e.file.includes(includeFilter.replace(/\*\*/g, "").replace(/\*/g, ""));
+    });
+    process.stderr.write(
+      `[tracegraph] Include filter "${includeFilter}": ${allEvents.length}/${before} events kept.
+`
+    );
+  }
+  if (allEvents.length > maxEvents) {
+    process.stderr.write(
+      `[tracegraph] Capping at ${maxEvents} events (${allEvents.length} total).
+`
+    );
+    allEvents = allEvents.slice(0, maxEvents);
+  }
+  const outDir = options.outDir ? import_path13.default.resolve(cwd, options.outDir) : import_path13.default.join(cwd, ".tracegraph", "traces");
+  if (!import_fs11.default.existsSync(outDir)) {
+    import_fs11.default.mkdirSync(outDir, { recursive: true });
+  }
+  const jsonlPath = import_path13.default.join(outDir, `${traceId}.events.jsonl`);
+  const lines = allEvents.map((e) => JSON.stringify(e)).join("\n") + "\n";
+  import_fs11.default.writeFileSync(jsonlPath, lines, "utf8");
+  const runDir = import_path13.default.dirname(jsonlPath);
+  try {
+    import_fs11.default.writeFileSync(
+      import_path13.default.join(runDir, "capture-level.json"),
+      JSON.stringify({
+        overall: 3,
+        label: "Xdebug import (function call detail)",
+        adapters: {
+          xdebug: {
+            level: 3,
+            mode: "xdebug-import",
+            captured: ["function_call", "return", "file", "line", "timing"]
+          }
+        }
+      }, null, 2) + "\n",
+      "utf8"
+    );
+  } catch {
+  }
+  process.stdout.write(
+    `[tracegraph] Wrote ${allEvents.length} events to ${jsonlPath}
+`
+  );
+  process.stdout.write(`[tracegraph] Trace ID: ${traceId}
+`);
+  return import_shared_types9.EXIT_CODES.SUCCESS;
+}
+function buildEventsFromXdebug(entries, traceId, traceStartMs) {
+  const events = [];
+  const stack = [];
+  const rootId = (0, import_trace_core6.createEventId)();
+  events.push({
+    schemaVersion: import_shared_types9.SCHEMA_VERSIONS.event,
+    eventId: rootId,
+    traceId,
+    parentEventId: null,
+    type: "function_call",
+    language: "php",
+    framework: "xdebug",
+    name: "xdebug import",
+    startTime: traceStartMs
+  });
+  for (const entry of entries) {
+    if (entry.kind === "marker") continue;
+    while (stack.length > 0 && stack[stack.length - 1].depth >= entry.depth) {
+      stack.pop();
+    }
+    const parentId = stack.length > 0 ? stack[stack.length - 1].eventId : rootId;
+    const absoluteMs = Math.round(traceStartMs + entry.timeIndex * 1e3);
+    if (entry.kind === "entry") {
+      const eventId = (0, import_trace_core6.createEventId)();
+      events.push({
+        schemaVersion: import_shared_types9.SCHEMA_VERSIONS.event,
+        eventId,
+        traceId,
+        parentEventId: parentId,
+        type: "function_call",
+        language: "php",
+        framework: "xdebug",
+        name: entry.fnName,
+        functionName: entry.fnName,
+        startTime: absoluteMs,
+        file: entry.file,
+        metadata: {
+          xdebugDepth: entry.depth,
+          memoryBytes: entry.memoryBytes
+        }
+      });
+      stack.push({ eventId, depth: entry.depth });
+    } else {
+      events.push({
+        schemaVersion: import_shared_types9.SCHEMA_VERSIONS.event,
+        eventId: (0, import_trace_core6.createEventId)(),
+        traceId,
+        parentEventId: parentId,
+        type: "return",
+        language: "php",
+        framework: "xdebug",
+        name: `${entry.fnName} \u2192 return`,
+        startTime: absoluteMs
+      });
+    }
+  }
+  return events;
+}
+
+// src/commands/schema.ts
+var import_fs12 = __toESM(require("fs"));
+var import_path14 = __toESM(require("path"));
+var import_shared_types10 = require("@tracegraph/shared-types");
+function schemaDoctorCommand(options) {
+  const cwd = process.cwd();
+  const tracegraphDir = import_path14.default.join(cwd, ".tracegraph");
+  if (!import_fs12.default.existsSync(tracegraphDir)) {
+    process.stdout.write("[tracegraph] No .tracegraph/ directory found \u2014 nothing to check.\n");
+    return import_shared_types10.EXIT_CODES.SUCCESS;
+  }
+  const reports = [
+    ...scanDir(import_path14.default.join(tracegraphDir, "traces"), "trace", import_shared_types10.SCHEMA_VERSIONS.trace),
+    ...scanDir(import_path14.default.join(tracegraphDir, "baselines"), "baseline", import_shared_types10.SCHEMA_VERSIONS.baseline),
+    ...scanDir(import_path14.default.join(tracegraphDir, "reports"), "report", import_shared_types10.SCHEMA_VERSIONS.report)
+  ];
+  if (options.json) {
+    process.stdout.write(JSON.stringify(reports, null, 2) + "\n");
+    return reports.some((r) => r.status !== "ok") ? import_shared_types10.EXIT_CODES.SCHEMA_MIGRATION : import_shared_types10.EXIT_CODES.SUCCESS;
+  }
+  const ok = reports.filter((r) => r.status === "ok");
+  const mismatched = reports.filter((r) => r.status === "mismatch");
+  const unreadable = reports.filter((r) => r.status === "unreadable");
+  const LINE2 = "\u2500".repeat(56);
+  process.stdout.write("\nTraceGraph Schema Doctor\n");
+  process.stdout.write(LINE2 + "\n");
+  process.stdout.write(`Total artifacts scanned: ${reports.length}
+`);
+  process.stdout.write(`  \u2713 Current:    ${ok.length}
+`);
+  process.stdout.write(`  \u2717 Mismatched: ${mismatched.length}
+`);
+  if (unreadable.length > 0) {
+    process.stdout.write(`  \u26A0 Unreadable: ${unreadable.length}
+`);
+  }
+  if (mismatched.length === 0 && unreadable.length === 0) {
+    process.stdout.write("\nAll artifacts are at the current schema version.\n");
+    process.stdout.write(LINE2 + "\n\n");
+    return import_shared_types10.EXIT_CODES.SUCCESS;
+  }
+  if (mismatched.length > 0) {
+    process.stdout.write("\nMismatched artifacts:\n");
+    for (const r of mismatched) {
+      process.stdout.write(
+        `  ${r.kind.padEnd(10)} ${import_path14.default.basename(r.file)}
+             found: ${r.foundVersion ?? "(none)"}
+          expected: ${r.expectedVersion}
+`
+      );
+    }
+    process.stdout.write("\nRun the appropriate migration:\n");
+    if (mismatched.some((r) => r.kind === "baseline")) {
+      process.stdout.write("  tracegraph baseline migrate\n");
+    }
+    if (mismatched.some((r) => r.kind === "trace" || r.kind === "report")) {
+      process.stdout.write("  tracegraph clean --all-runs  (traces and reports are regenerated by re-running)\n");
+    }
+  }
+  if (unreadable.length > 0) {
+    process.stdout.write("\nUnreadable files (corrupt or empty):\n");
+    for (const r of unreadable) {
+      process.stdout.write(`  ${r.kind.padEnd(10)} ${import_path14.default.basename(r.file)}
+`);
+    }
+  }
+  process.stdout.write(LINE2 + "\n\n");
+  return import_shared_types10.EXIT_CODES.SCHEMA_MIGRATION;
+}
+function baselineMigrateCommand(options) {
+  const cwd = process.cwd();
+  const baselinesDir = import_path14.default.join(cwd, ".tracegraph", "baselines");
+  if (!import_fs12.default.existsSync(baselinesDir)) {
+    process.stdout.write("[tracegraph] No baselines directory found \u2014 nothing to migrate.\n");
+    return import_shared_types10.EXIT_CODES.SUCCESS;
+  }
+  const files = import_fs12.default.readdirSync(baselinesDir).filter((f) => f.endsWith(".baseline.json")).map((f) => import_path14.default.join(baselinesDir, f));
+  if (files.length === 0) {
+    process.stdout.write("[tracegraph] No baseline files found.\n");
+    return import_shared_types10.EXIT_CODES.SUCCESS;
+  }
+  let migrated = 0;
+  let skipped = 0;
+  let failed = 0;
+  for (const file of files) {
+    let raw;
+    try {
+      raw = JSON.parse(import_fs12.default.readFileSync(file, "utf8"));
+    } catch {
+      process.stderr.write(`  [error] Cannot read ${import_path14.default.basename(file)} \u2014 skipping.
+`);
+      failed++;
+      continue;
+    }
+    if (raw["schemaVersion"] === import_shared_types10.SCHEMA_VERSIONS.baseline) {
+      skipped++;
+      continue;
+    }
+    const oldVersion = raw["schemaVersion"];
+    if (typeof raw["baselineId"] === "string" && typeof raw["testId"] === "string" && Array.isArray(raw["events"])) {
+      raw["schemaVersion"] = import_shared_types10.SCHEMA_VERSIONS.baseline;
+      if (options.dryRun) {
+        process.stdout.write(
+          `  [dry-run] Would migrate ${import_path14.default.basename(file)}: ${oldVersion ?? "(none)"} \u2192 ${import_shared_types10.SCHEMA_VERSIONS.baseline}
+`
+        );
+      } else {
+        import_fs12.default.writeFileSync(file, JSON.stringify(raw, null, 2) + "\n", "utf8");
+        process.stdout.write(
+          `  [ok] Migrated ${import_path14.default.basename(file)}: ${oldVersion ?? "(none)"} \u2192 ${import_shared_types10.SCHEMA_VERSIONS.baseline}
+`
+        );
+      }
+      migrated++;
+    } else {
+      process.stderr.write(
+        `  [warn] ${import_path14.default.basename(file)} schema is incompatible \u2014 cannot auto-migrate.
+         Regenerate with: tracegraph baseline create --all-traces
+`
+      );
+      failed++;
+    }
+  }
+  process.stdout.write(
+    `
+[tracegraph] baseline migrate: ${migrated} migrated, ${skipped} already current, ${failed} failed.
+`
+  );
+  return failed > 0 ? import_shared_types10.EXIT_CODES.SCHEMA_MIGRATION : import_shared_types10.EXIT_CODES.SUCCESS;
+}
+function scanDir(dir, kind, expectedVersion) {
+  if (!import_fs12.default.existsSync(dir)) return [];
+  const ext = kind === "trace" ? ".trace.json" : kind === "baseline" ? ".baseline.json" : ".report.json";
+  return import_fs12.default.readdirSync(dir).filter((f) => f.endsWith(ext)).map((f) => {
+    const file = import_path14.default.join(dir, f);
+    try {
+      const data = JSON.parse(import_fs12.default.readFileSync(file, "utf8"));
+      const foundVersion = data["schemaVersion"] ?? null;
+      return {
+        file,
+        kind,
+        foundVersion,
+        expectedVersion,
+        status: foundVersion === expectedVersion ? "ok" : "mismatch"
+      };
+    } catch {
+      return { file, kind, foundVersion: null, expectedVersion, status: "unreadable" };
+    }
+  });
+}
+
+// src/commands/scenario.ts
+var import_fs13 = __toESM(require("fs"));
+var import_path15 = __toESM(require("path"));
+var import_shared_types11 = require("@tracegraph/shared-types");
+var import_scenario_runner = require("@tracegraph/scenario-runner");
+async function scenarioRunCommand(scenarioFile, options = {}) {
+  const cwd = options.workspaceRoot ?? process.cwd();
+  const absScenario = import_path15.default.resolve(cwd, scenarioFile);
+  process.stderr.write(
+    `[tracegraph] Running scenario: ${import_path15.default.relative(cwd, absScenario)}
+`
+  );
+  try {
+    const result = await (0, import_scenario_runner.runScenario)(absScenario, { workspaceRoot: cwd });
+    for (const step of result.steps) {
+      const icon = step.status === "passed" ? "  \u2713" : step.status === "skipped" ? "  \u2013" : "  \u2717";
+      const extra = step.error ? ` \u2014 ${step.error}` : step.statusCode ? ` [${step.statusCode}]` : "";
+      process.stderr.write(`${icon} ${step.name}${extra}
+`);
+    }
+    const statusLabel = result.passed ? "\u2713 passed" : "\u2717 failed";
+    process.stderr.write(
+      `[tracegraph] Scenario "${result.scenarioId}" ${statusLabel} (${result.steps.length} step(s), ${result.durationMs}ms)
+`
+    );
+    if (result.bundleFile) {
+      process.stderr.write(`[tracegraph] Bundle written: ${result.bundleFile}
+`);
+      process.stdout.write(
+        JSON.stringify({
+          protocol: "tracegraph.cli.v1",
+          type: "bundle.created",
+          runId: result.runId,
+          timestamp: Date.now(),
+          payload: {
+            file: result.bundleFile,
+            scenarioId: result.scenarioId
+          }
+        }) + "\n"
+      );
+    }
+    return result.passed ? import_shared_types11.EXIT_CODES.SUCCESS : import_shared_types11.EXIT_CODES.COMMAND_FAILURE;
+  } catch (err) {
+    process.stderr.write(`[tracegraph] Error: ${String(err)}
+`);
+    return import_shared_types11.EXIT_CODES.CLI_ERROR;
+  }
+}
+function scenarioValidateCommand(scenarioFile) {
+  const cwd = process.cwd();
+  const abs = import_path15.default.resolve(cwd, scenarioFile);
+  try {
+    const def = (0, import_scenario_runner.loadScenarioDefinition)(abs);
+    const servers = def.servers ?? [];
+    const lines = [
+      `\u2713  ${def.name} (${def.scenarioId})`,
+      `   Steps:   ${def.steps.length}`,
+      `   Servers: ${servers.length}`
+    ];
+    if (servers.length > 0) {
+      for (const s of servers) {
+        lines.push(`     \u2022 ${s.name}  port ${s.port}  "${s.command}"`);
+      }
+    }
+    if (def.tags?.length) {
+      lines.push(`   Tags: ${def.tags.join(", ")}`);
+    }
+    process.stdout.write(lines.join("\n") + "\n");
+    return import_shared_types11.EXIT_CODES.SUCCESS;
+  } catch (err) {
+    process.stderr.write(`[tracegraph] Invalid scenario: ${String(err)}
+`);
+    return import_shared_types11.EXIT_CODES.CLI_ERROR;
+  }
+}
+function scenarioListCommand() {
+  const cwd = process.cwd();
+  const scenariosDir = import_path15.default.join(cwd, ".tracegraph", "scenarios");
+  if (!import_fs13.default.existsSync(scenariosDir)) {
+    process.stdout.write(
+      "No scenarios directory found.\nCreate .tracegraph/scenarios/ and add *.scenario.json files.\n"
+    );
+    return import_shared_types11.EXIT_CODES.SUCCESS;
+  }
+  const files = import_fs13.default.readdirSync(scenariosDir).filter((f) => f.endsWith(".scenario.json")).sort();
+  if (files.length === 0) {
+    process.stdout.write(
+      "No scenario files found in .tracegraph/scenarios/\n"
+    );
+    return import_shared_types11.EXIT_CODES.SUCCESS;
+  }
+  process.stdout.write(`Scenarios in .tracegraph/scenarios/ (${files.length}):
+
+`);
+  for (const file of files) {
+    const abs = import_path15.default.join(scenariosDir, file);
+    try {
+      const def = JSON.parse(import_fs13.default.readFileSync(abs, "utf8"));
+      const name = def.name ?? def.scenarioId ?? file;
+      const nSteps = (def.steps ?? []).length;
+      const nSrvs = (def.servers ?? []).length;
+      process.stdout.write(
+        `  ${file}
+    ${name} \u2014 ${nSteps} step(s), ${nSrvs} server(s)
+`
+      );
+    } catch {
+      process.stdout.write(`  ${file} (unreadable)
+`);
+    }
+  }
+  return import_shared_types11.EXIT_CODES.SUCCESS;
+}
+
+// src/commands/coverage.ts
+var fs14 = __toESM(require("fs"));
+var path16 = __toESM(require("path"));
+var import_ai_coverage = require("@tracegraph/ai-coverage");
+var import_shared_types12 = require("@tracegraph/shared-types");
+function coverageCommand(options = {}) {
+  const {
+    base = "HEAD~1",
+    head = "HEAD",
+    traces,
+    out,
+    json: printJson = false,
+    failUncovered = false
+  } = options;
+  const cwd = process.cwd();
+  const tracesDir = traces ? path16.resolve(cwd, traces) : path16.join(cwd, ".tracegraph", "traces");
+  let report;
+  try {
+    report = (0, import_ai_coverage.computeCoverage)({
+      baseRef: base,
+      headRef: head,
+      tracesDir,
+      cwd
+    });
+  } catch (err) {
+    process.stderr.write(`[tracegraph coverage] Error: ${String(err)}
+`);
+    return import_shared_types12.EXIT_CODES.CLI_ERROR;
+  }
+  const reportsDir = path16.join(cwd, ".tracegraph", "reports");
+  const outFile = out ? path16.resolve(cwd, out) : path16.join(reportsDir, `${report.reportId}.coverage.json`);
+  try {
+    fs14.mkdirSync(path16.dirname(outFile), { recursive: true });
+    fs14.writeFileSync(outFile, JSON.stringify(report, null, 2), "utf8");
+  } catch (err) {
+    process.stderr.write(`[tracegraph coverage] Failed to write report: ${String(err)}
+`);
+    return import_shared_types12.EXIT_CODES.CLI_ERROR;
+  }
+  const { summary } = report;
+  process.stderr.write("\n");
+  process.stderr.write(`  tracegraph coverage
+`);
+  process.stderr.write(`  diff:  ${report.baseRef}..${report.headRef}
+`);
+  process.stderr.write(`  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`);
+  process.stderr.write(`  Changed functions: ${summary.changedFunctions}
+`);
+  process.stderr.write(`  Covered:           ${summary.coveredCount}
+`);
+  process.stderr.write(`  Uncovered:         ${summary.uncoveredCount}
+`);
+  process.stderr.write(`  Coverage:          ${summary.coveragePercent}%
+`);
+  if (report.uncovered.length > 0) {
+    process.stderr.write("\n  Uncovered changed functions:\n");
+    for (const fn of report.uncovered) {
+      process.stderr.write(`    \u2717  ${formatFunction(fn)}  (${fn.file}:${fn.startLine})
+`);
+    }
+  }
+  if (report.covered.length > 0) {
+    process.stderr.write("\n  Covered changed functions:\n");
+    for (const entry of report.covered) {
+      process.stderr.write(
+        `    \u2713  ${formatFunction(entry.changed)}  \u2014 ${entry.coveredBy.length} trace(s)
+`
+      );
+    }
+  }
+  process.stderr.write(`
+  Report: ${outFile}
+
+`);
+  if (printJson) {
+    process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  }
+  if (failUncovered && report.uncovered.length > 0) {
+    return import_shared_types12.EXIT_CODES.COMMAND_FAILURE;
+  }
+  return import_shared_types12.EXIT_CODES.SUCCESS;
+}
+function formatFunction(fn) {
+  if (fn.className && fn.methodName) {
+    return `${fn.className}.${fn.methodName}()`;
+  }
+  return `${fn.functionName ?? "(unknown)"}()`;
+}
+
+// src/commands/pack.ts
+var fs15 = __toESM(require("fs"));
+var path17 = __toESM(require("path"));
+var import_ai_coverage2 = require("@tracegraph/ai-coverage");
+var import_shared_types13 = require("@tracegraph/shared-types");
+var ALL_FORMATS = ["cursor", "claude-code", "copilot", "mcp"];
+var VALID_FORMATS = /* @__PURE__ */ new Set([...ALL_FORMATS, "all"]);
+function packCommand(options = {}) {
+  const {
+    format: formatArg = "all",
+    report: reportArg,
+    traces: tracesArg,
+    outDir: outDirArg,
+    project: projectName,
+    maxChars = 4e4,
+    dryRun = false
+  } = options;
+  const cwd = process.cwd();
+  if (!VALID_FORMATS.has(formatArg)) {
+    process.stderr.write(
+      `[tracegraph pack] Unknown format "${formatArg}". Valid values: cursor, claude-code, copilot, mcp, all
+`
+    );
+    return import_shared_types13.EXIT_CODES.CLI_ERROR;
+  }
+  const formats = formatArg === "all" ? ALL_FORMATS : [formatArg];
+  const reportFile = reportArg ? path17.resolve(cwd, reportArg) : findLatestReport(cwd);
+  if (!reportFile) {
+    process.stderr.write(
+      "[tracegraph pack] No report file found. Run `tracegraph compare` first, or supply --report <file>.\n"
+    );
+    return import_shared_types13.EXIT_CODES.CLI_ERROR;
+  }
+  if (!fs15.existsSync(reportFile)) {
+    process.stderr.write(`[tracegraph pack] Report not found: ${reportFile}
+`);
+    return import_shared_types13.EXIT_CODES.CLI_ERROR;
+  }
+  const traceFiles = resolveTraceFiles2(tracesArg, cwd);
+  const resolvedProjectName = projectName ?? resolveProjectName(cwd);
+  let packs;
+  try {
+    packs = (0, import_ai_coverage2.buildPromptPacks)({
+      formats,
+      report: reportFile,
+      traceFiles,
+      maxContextChars: maxChars,
+      projectName: resolvedProjectName
+    });
+  } catch (err) {
+    process.stderr.write(`[tracegraph pack] Error building packs: ${String(err)}
+`);
+    return import_shared_types13.EXIT_CODES.CLI_ERROR;
+  }
+  const outBase = outDirArg ? path17.resolve(cwd, outDirArg) : cwd;
+  process.stderr.write("\n");
+  if (dryRun) {
+    process.stderr.write("  tracegraph pack (dry run)\n");
+  } else {
+    process.stderr.write("  tracegraph pack\n");
+  }
+  process.stderr.write(`  report: ${reportFile}
+`);
+  process.stderr.write(`  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`);
+  let errCount = 0;
+  for (const pack of packs) {
+    const destFile = path17.join(outBase, pack.fileName);
+    const rel = path17.relative(cwd, destFile);
+    if (dryRun) {
+      process.stderr.write(`  [dry-run] would write: ${rel} (${pack.format})
+`);
+      continue;
+    }
+    try {
+      fs15.mkdirSync(path17.dirname(destFile), { recursive: true });
+      fs15.writeFileSync(destFile, pack.content, "utf8");
+      process.stderr.write(`  \u2713 wrote: ${rel}
+`);
+    } catch (err) {
+      process.stderr.write(`  \u2717 failed: ${rel} \u2014 ${String(err)}
+`);
+      errCount++;
+    }
+  }
+  process.stderr.write("\n");
+  return errCount > 0 ? import_shared_types13.EXIT_CODES.CLI_ERROR : import_shared_types13.EXIT_CODES.SUCCESS;
+}
+function findLatestReport(cwd) {
+  const latestJsonPath = path17.join(cwd, ".tracegraph", "latest.json");
+  if (fs15.existsSync(latestJsonPath)) {
+    try {
+      const latest = JSON.parse(fs15.readFileSync(latestJsonPath, "utf8"));
+      if (latest.latestReportId) {
+        const reportPath = path17.join(
+          cwd,
+          ".tracegraph",
+          "reports",
+          `${latest.latestReportId}.report.json`
+        );
+        if (fs15.existsSync(reportPath)) return reportPath;
+      }
+    } catch {
+    }
+  }
+  const reportsDir = path17.join(cwd, ".tracegraph", "reports");
+  if (!fs15.existsSync(reportsDir)) return null;
+  try {
+    const files = fs15.readdirSync(reportsDir).filter((f) => f.endsWith(".report.json")).map((f) => ({
+      file: path17.join(reportsDir, f),
+      mtime: fs15.statSync(path17.join(reportsDir, f)).mtimeMs
+    })).sort((a, b) => b.mtime - a.mtime);
+    return files[0]?.file ?? null;
+  } catch {
+    return null;
+  }
+}
+function resolveTraceFiles2(tracesArg, cwd) {
+  if (!tracesArg) {
+    const tracesDir = path17.join(cwd, ".tracegraph", "traces");
+    if (!fs15.existsSync(tracesDir)) return [];
+    try {
+      return fs15.readdirSync(tracesDir).filter((f) => f.endsWith(".trace.json")).map((f) => path17.join(tracesDir, f));
+    } catch {
+      return [];
+    }
+  }
+  const resolved = path17.resolve(cwd, tracesArg);
+  if (fs15.existsSync(resolved) && fs15.statSync(resolved).isDirectory()) {
+    try {
+      return fs15.readdirSync(resolved).filter((f) => f.endsWith(".trace.json")).map((f) => path17.join(resolved, f));
+    } catch {
+      return [];
+    }
+  }
+  return fs15.existsSync(resolved) ? [resolved] : [];
+}
+function resolveProjectName(cwd) {
+  const pkgPath = path17.join(cwd, "package.json");
+  if (fs15.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs15.readFileSync(pkgPath, "utf8"));
+      if (pkg.name) return pkg.name;
+    } catch {
+    }
+  }
+  return path17.basename(cwd);
+}
+
+// src/index.ts
+var rawArgv = process.argv.slice(2);
+var ddIdx = rawArgv.indexOf("--");
+var tgArgv = ddIdx === -1 ? rawArgv : rawArgv.slice(0, ddIdx);
+var wrappedArgs = ddIdx === -1 ? [] : rawArgv.slice(ddIdx + 1);
+var program = new import_commander.Command();
+program.name("tracegraph").description("Capture how code actually behaves during tests, scenarios, and local development runs, then produces trace files, behavior graphs, baselines, diffs, findings, and reports that help code reviewers with with runtime evidence of code changes.").version("0.0.1");
+program.command("run").description("Run a command with tracing enabled").option("--run-id <id>", "Override the generated run ID").option("--scenario-id <id>", "Tag this run with a scenario/PR correlation ID").action(async (options) => {
+  const code = await runCommand(wrappedArgs, options);
+  process.exit(code);
+});
+var baselineCmd = program.command("baseline").description("Manage behaviour baselines");
+baselineCmd.command("create").description("Create baselines from traces (defaults to latest run)").option("--reason <reason>", "Approval reason (non-interactive mode)").option("--approved-by <name>", "Approver name (defaults to current user)").option("--all", "Overwrite existing baselines").option("--latest-run", "Use traces from the most recent run (default)").option("--run-id <id>", "Use traces from a specific run ID").option("--all-traces", "Use ALL traces in .tracegraph/traces/ (overrides default scope)").option("--only-passed", 'Skip traces whose status is not "passed"').action((options) => {
+  process.exit(baselineCreateCommand(options));
+});
+baselineCmd.command("list").description("List all stored baselines").action(() => {
+  process.exit(baselineListCommand());
+});
+baselineCmd.command("migrate").description("Migrate baseline files to the current schema version").option("--dry-run", "Show what would be migrated without writing changes").action((options) => {
+  process.exit(baselineMigrateCommand(options));
+});
+baselineCmd.command("approve").description("Approve (re-approve) an existing baseline").argument("<baseline-id>", "Baseline ID or test ID").requiredOption("--reason <reason>", "Approval reason").option("--approved-by <name>", "Approver name").action((baselineId, options) => {
+  process.exit(baselineApproveCommand(baselineId, options));
+});
+program.command("compare").description("Compare candidate traces against baselines and produce a report").option("--baseline <dir>", "Directory containing baseline files").option("--candidate <file>", "Candidate trace file or directory (default: latest run)").option("--bundle <file>", "TraceBundle JSON file \u2014 compare all traces in the bundle").option("--out <file>", "Output path for the report JSON").option("--latest", "Compare only traces from the most recent run (reads .tracegraph/latest.json)").option("--fail-on-critical", "Exit 3 if any critical findings are open").action((options) => {
+  process.exit(compareCommand(options));
+});
+var findingCmd = program.command("finding").description("Manage findings");
+findingCmd.command("list").description("List all findings from the latest report").option("--report <file>", "Path to a specific report JSON").action((options) => {
+  process.exit(findingListCommand(options.report));
+});
+findingCmd.command("approve").description("Approve a finding by fingerprint").argument("<fingerprint>", "Finding fingerprint (16-char hex)").requiredOption("--reason <reason>", "Approval reason").option("--approved-by <name>", "Approver name").option("--expires <ISO-date>", "Approval expiry date (default: 1 year)").action((fingerprint, options) => {
+  process.exit(findingApproveCommand(fingerprint, options));
+});
+findingCmd.command("suppress").description("Add a suppression for a finding").argument("<fingerprint>", "Finding fingerprint (16-char hex)").requiredOption("--reason <reason>", "Suppression reason").option("--approved-by <name>", "Approver name").option("--expires <ISO-date>", "Expiry date").option("--requires-evidence <type:name>", "Evidence required for suppression to be active").action((fingerprint, options) => {
+  process.exit(findingSuppressCommand(fingerprint, options));
+});
+findingCmd.command("explain").description("Show a detailed explanation of a finding by fingerprint").argument("<fingerprint>", "Finding fingerprint (or unique prefix)").option("--report <file>", "Path to a specific report JSON").option("--json", "Output raw JSON instead of human-readable text").action((fingerprint, options) => {
+  process.exit(findingExplainCommand(fingerprint, options));
+});
+program.command("report").description("Render a trace report in the requested format").option("--format <format>", "Output format: markdown | json | github-step-summary", "markdown").option("--input <file>", "Path to a specific .report.json file").option("--out <file>", "Write rendered output to this file instead of stdout").option("--project-name <name>", "Project name for the report header").action((options) => {
+  process.exit(reportCommand(options));
+});
+program.command("open").description("Open a trace or report in the browser").option("--html", "Produce a self-contained HTML file").option("--out <path>", "Output path for the HTML file").option("--no-open", "Write the HTML file but do not open a browser").argument("[file]", "Trace JSON file to open").action((file, options) => {
+  if (!file) {
+    process.stderr.write("Usage: tracegraph open --html <trace-file>\n");
+    process.exit(import_shared_types14.EXIT_CODES.CLI_ERROR);
+  }
+  openCommand(file, { out: options.out, noOpen: options.open === false });
+  process.exit(import_shared_types14.EXIT_CODES.SUCCESS);
+});
+program.command("init").description("Initialise TraceGraph in the current project").action(() => {
+  initCommand();
+  process.exit(import_shared_types14.EXIT_CODES.SUCCESS);
+});
+program.command("diagnose").description("Show what is being captured and how to improve the capture level").option("--trace <traceId>", "Diagnose a specific trace by ID or file path").option("--json", "Output as JSON instead of human-readable text").action((options) => {
+  process.exit(diagnoseCommand(options));
+});
+var schemaCmd = program.command("schema").description("Inspect and migrate TraceGraph artifact schemas");
+schemaCmd.command("doctor").description("Scan local artifacts for schema version mismatches").option("--json", "Output report as JSON instead of human-readable text").action((options) => {
+  process.exit(schemaDoctorCommand(options));
+});
+var importCmd = program.command("import").description("Import traces from external tools");
+importCmd.command("xdebug").description("Import an Xdebug .xt trace file, optionally merging with a Laravel semantic trace").argument("<file>", "Path to the Xdebug .xt trace file").option("--semantic <file>", "Path to a Laravel semantic JSONL trace to merge with").option("--include <pattern>", "Only include functions whose file path matches this pattern").option("--max-events <n>", "Maximum number of events to emit (default: 10000)", parseInt).option("--out-dir <dir>", "Output directory (default: .tracegraph/traces/)").action(async (file, options) => {
+  process.exit(await importXdebugCommand(file, options));
+});
+var scenarioCmd = program.command("scenario").description("Run and manage TraceGraph scenarios");
+scenarioCmd.command("run").description("Execute a scenario definition file end-to-end").argument("<file>", "Path to the .scenario.json file").action(async (file) => {
+  process.exit(await scenarioRunCommand(file));
+});
+scenarioCmd.command("validate").description("Validate a scenario file structure without running it").argument("<file>", "Path to the .scenario.json file").action((file) => {
+  process.exit(scenarioValidateCommand(file));
+});
+scenarioCmd.command("list").description("List scenario files in .tracegraph/scenarios/").action(() => {
+  process.exit(scenarioListCommand());
+});
+program.command("coverage").description("Map changed functions (git diff) to runtime trace coverage").option("--base <ref>", "Git ref to diff from (default: HEAD~1)").option("--head <ref>", "Git ref to diff to (default: HEAD)").option("--traces <dir>", "Directory containing .trace.json files").option("--out <file>", "Write coverage report JSON to this file").option("--json", "Also print the full report JSON to stdout").option("--fail-uncovered", "Exit 1 if any changed functions have no trace coverage").action((options) => {
+  process.exit(coverageCommand(options));
+});
+program.command("pack").description("Generate AI context packs (Cursor / Claude Code / Copilot / MCP) from findings").option("--format <fmt>", "cursor | claude-code | copilot | mcp | all (default: all)").option("--report <file>", "Path to a .report.json file (default: latest report)").option("--traces <dir>", "Directory of .trace.json files to include as context").option("--out-dir <dir>", "Output directory for pack files (default: project root)").option("--project <name>", "Project name for pack headers").option("--max-chars <n>", "Max trace context characters per pack", parseInt).option("--dry-run", "Print what would be written without writing files").action((options) => {
+  process.exit(packCommand(options));
+});
+program.command("clean").description("Remove local trace run artifacts").option("--older-than <age>", "Remove runs older than this (e.g. 7d, 12h)").option("--keep-last <n>", "Keep the N most recent runs", parseInt).option("--all-runs", "Remove all runs (baselines are never removed)").action((options) => {
+  cleanCommand(options);
+  process.exit(import_shared_types14.EXIT_CODES.SUCCESS);
+});
+var storageCmd = program.command("storage").description("Manage local trace storage");
+storageCmd.command("status").description("Show storage usage for the current project").action(() => {
+  storageStatusCommand();
+  process.exit(import_shared_types14.EXIT_CODES.SUCCESS);
+});
+program.parseAsync(["node", "tracegraph", ...tgArgv]).catch((err) => {
+  process.stderr.write(`[tracegraph] Unexpected error: ${String(err)}
+`);
+  process.exit(import_shared_types14.EXIT_CODES.CLI_ERROR);
+});